Fix infinite redirect loop when multiple cookies are sent #50452

jportner · 2019-11-13T04:40:09Z

Summary

The existing session cookie implementation was brittle in terms of handling changes to configuration. Specifically, if a Kibana installation change its base path, or enabled secure session cookies, any existing cookies would still be sent by the browser. However, these outdated cookies would not ever be deleted because of the default behavior of the Hapi cookie authentication plugin.

I made the following changes:

Add path and secure attributes to encrypted cookie session value contents
Modify session cookie validation check to detect and invalidate cookies with outdated attributes that do not match the current server configuration

Note: cookies that do not contain these attributes are assumed to have been created with the current configuration. I.e., this will only resolve configuration mismatch issues for cookies that were created with this change in place.

Resolves #36825.

Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

This was checked for cross-browser compatibility, including a check against IE11
~~[ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support~~
~~[ ] Documentation was added for features that require explanation or tutorials~~
Unit or functional tests were updated or added to match the most common scenarios
~~[ ] This was checked for keyboard-only and screenreader accessibility~~

For maintainers

This was checked for breaking API changes and was labeled appropriately
~~[ ] This includes a feature addition or change that requires a release note and was labeled appropriately~~

jportner · 2019-11-13T04:51:36Z

src/core/server/http/cookie_session_storage.ts

+    log.debug(`Clearing invalid session cookie`);
+    // need to use Hapi toolkit to clear cookie with defined options
+    if (req) {
+      (req.cookieAuth as any).h.unstate(cookieOptions.name, { path, isSecure });


Needed to add code to clear invalid cookies by specifying the path and isSecure attributes (using the Hapi toolkit).

Note, because of this, we no longer need Hapi to automatically clear invalid cookies (see below).

jportner · 2019-11-13T04:53:12Z

src/core/server/http/cookie_session_storage.ts

    isSecure: cookieOptions.isSecure,
    path: basePath,
-    clearInvalid: true,
+    clearInvalid: false,


As mentioned above, we no longer need Hapi to automatically clear invalid cookies.

src/core/server/http/cookie_session_storage.ts

jportner

Author's notes for other reviewers.

elasticmachine · 2019-11-13T06:00:59Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 8eb4b9a

elasticmachine · 2019-11-13T17:34:13Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 70fcfe0

elasticmachine · 2019-11-13T21:28:39Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: f74e598

kobelb

This fixes the issue when going from being hosted at a non-basepath to being hosted at a basepath. However, it doesn't address the issue when going from https to http. Others have run into the https to http issue, and https://www.petefreitag.com/item/857.cfm describes the same situation.

Let's address the https to http issue in a separate PR. I think using a different cookie name for https vs http would be a good solution here, but it's something we'd want to do in a major version upgrade. In light of this information, do you mind removing the "secure cookies" part of this PR, since it's not fixing the issue?

x-pack/plugins/security/server/authentication/index.ts

Cookies are now checked for attributes that match the current Kibana configuration.

jportner · 2019-11-14T14:37:28Z

This fixes the issue when going from being hosted at a non-basepath to being hosted at a basepath. However, it doesn't address the issue when going from https to http. Others have run into the https to http issue, and https://www.petefreitag.com/item/857.cfm describes the same situation.

Ah, I tested with https enabled and toggling xpack.security.secureCookies between true and false (which may only happen if Kibana is sitting behind a reverse proxy). The current code does catch that difference and invalidate the cookie. However, we don't need to specify whether the cookie is Secure or not, because that attribute doesn't determine the scope of the cookie -- only Path and Domain determine scope. So the cookie would get overwritten anyway whenever the session is updated.

However, I didn't test like you mentioned above, going from https to http. I did a bit of reading and found this article: https://www.sjoerdlangkemper.nl/2017/10/25/strict-secure-cookies/
Apparently Google has proposed the "Strict Secure Cookies" specification, which is causing the issue you are describing. In this spec, a browser with an insecure connection (e.g., http) cannot overwrite or delete a Secure cookie.

It looks like this change was accepted in RFC 6265 version 01 (April 2017), and this shipped/enabled in Chrome 58 and Firefox 52.

Let's address the https to http issue in a separate PR. I think using a different cookie name for https vs http would be a good solution here, but it's something we'd want to do in a major version upgrade. In light of this information, do you mind removing the "secure cookies" part of this PR, since it's not fixing the issue?

Agree, and we should look at using Cookie Prefixes when that time comes.

We don't need to check this attribute, as it doesn't influence the scope of the cookie. Only `path` infleunces the cookie's scope.

elasticmachine · 2019-11-14T16:53:07Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 60d7789

elasticmachine · 2019-11-15T16:27:16Z

Pinging @elastic/kibana-security (Team:Security)

pgayvallet · 2019-11-16T11:14:28Z

src/core/server/http/cookie_session_storage.ts

-    validateFunc: async (req, session: T) => ({ valid: await cookieOptions.validate(session) }),
+    validateFunc: async (req, session: T) => {
+      const result = cookieOptions.validate(session);
+      if (!result.isValid) {
+        clearInvalidCookie(req, result.path);
+      }
+      return { valid: result.isValid };
+    },


Is there a way to keep the functionality while calling clearInvalidCookie outside of validateFunc ? Adding behaviour in a validation method looks like introducing side effects to me, so I would prefer to avoid it if we can.

I don't love that it's there, but I couldn't think of a better place to put it.

I originally had it in the X-Pack authentication module in the Security plugin:

kibana/x-pack/plugins/security/server/authentication/index.ts

Lines 68 to 99 in 60d7789

const isValid = (sessionValue: ProviderSession) => {

// ensure that this cookie was created with the current Kibana configuration

const { path, expires } = sessionValue;

if (path !== undefined && path !== (http.basePath.serverBasePath || '/')) {

authLogger.debug(`Outdated session value with path "${sessionValue.path}"`);

return false;

}

// ensure that this cookie is not expired

return !(expires && expires < Date.now());

};

const authenticator = new Authenticator({

clusterClient,

basePath: http.basePath,

config: { sessionTimeout: config.sessionTimeout, authc: config.authc },

isSystemAPIRequest: (request: KibanaRequest) => getLegacyAPI().isSystemAPIRequest(request),

loggers,

sessionStorageFactory: await http.createCookieSessionStorageFactory({

encryptionKey: config.encryptionKey,

isSecure: config.secureCookies,

name: config.cookieName,

validate: (session: ProviderSession) => {

const array: ProviderSession[] = Array.isArray(session) ? session : [session];

for (const sess of array) {

if (!isValid(sess)) {

return { isValid: false, path: sess.path };

}

}

return { isValid: true };

},

}),

});

However, I wanted to keep usage of the Hapi toolkit abstracted away from X-Pack, so I decided to move that code into Core in cookie_session_storage.ts.

If you have a better idea of where to put it, I'm all ears!

FWIW, Hapi's default behavior to clear the cookie (which I've overridden in this commit) already originates in its validation method. https://github.com/hapijs/cookie/blob/3a6e046e7adafafc382054000239c338a1a55d8c/lib/index.js#L197-L199

I guess it's we are doing nothing that hapi was already doing, this should be alright. Unless someone has a better idea on where we could move this (don't have much experience on hapi lifecycle), maybe @joshdover or @restrry?

What if the platform doesn't handle the removal, but the plugin controls it? Security plugin already has access to CookieStorage and can perform all setup/teardown logic.

I thought about that, but we are relying on the Hapi toolkit for the actual cookie removal -- right now we don't expose Hapi directly to plugins in the New Platform, we abstract it away. My impression was that we wanted to keep it that way.

Correct, but we can extend API and provide methods to remove the cookie. This method will be a wrapper around hapi

Ok, nvm. The core defines the auth strategy and sets the cookie in hapi. Probably, it's better to keep your current implementation with explicit removal in the core. Ok for me

Okay, thanks!

@pgayvallet any other concerns or nits?

src/core/server/http/cookie_session_storage.ts

x-pack/plugins/security/server/authentication/authenticator.test.ts

x-pack/plugins/security/server/authentication/index.ts

mshustov · 2019-11-22T09:46:51Z

x-pack/plugins/security/server/authentication/index.ts

+        const array: ProviderSession[] = Array.isArray(session) ? session : [session];
+        for (const sess of array) {
+          if (!isValid(sess)) {
+            return { isValid: false, path: sess.path };


so, validate function returns on the very first invalid cookie and removes only it?

Yes, that's correct.

It's because we're using the Hapi toolkit to clear the cookie (which is the same method that the Hapi Cookie plugin uses under the hood in our current implementation -- we are just passing it an extra parameter). However, the Hapi toolkit can only clear one cookie at a time. This sounded like an acceptable approach to me because:

The only time we'll ever see multiple cookies is if the client has stored several more than one cookie with the same name and different, overlapping paths (e.g., / and /foo)

If multiple cookies are sent and they are all invalid (very unlikely), the client will make multiple round trips and delete each one; this will happen near-instantaneously and be imperceptible to the end user

The alternative was to try to reimplement that logic in a different way so we could delete multiple cookies in a single response, but that seemed unnecessary and risky -- we know the existing method works, and we want to avoid mucking around with Hapi under the hood as much as possible.

The validate callback can expect to receive ProviderSession or an array of ProviderSessions. The types have been updated to reflect that.

elasticmachine · 2019-11-22T15:40:43Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: c7f9e12

…ultiple-cookies

elasticmachine · 2019-11-25T18:57:50Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 16ad27c

…ultiple-cookies

elasticmachine · 2019-11-26T18:03:14Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 85e51fd

pgayvallet

platform changes LGTM

) Cookies are now checked for attributes that match the current Kibana configuration. Invalid cookies are cleared more reliably.

…51821) Cookies are now checked for attributes that match the current Kibana configuration. Invalid cookies are cleared more reliably.

* upstream/7.x: Fix infinite redirect loop when multiple cookies are sent (elastic#50452) (elastic#51821) [Console] Proxy fallback (elastic#50185) (elastic#51814) Added endgame-* index and new heading 3 Elastic Endpoint SMP. (elastic#51071) (elastic#51828) [Maps] Added options to disable zoom, hide tool tips, widgets/overlays in embeddable maps (elastic#50663) (elastic#51811) Move errors and validate index pattern ⇒ NP (elastic#51805) (elastic#51831) [SIEM][Detection Engine] Adds ecs threat properties to rules (elastic#51782) (elastic#51827) [Lens] Remove client-side reference to server source code (elastic#51763) (elastic#51825) fixes drag and drop in tests (elastic#51806) (elastic#51813) [Uptime] Redesign/44541 new monitor list expanded row (elastic#46567) (elastic#51809) [7.x] [Telemetry] collector set to np (elastic#51618) (elastic#51787) [Uptime] added test for chart wrapper (elastic#50399) (elastic#51808) Expressions service fixes: better error and loading states handling (elastic#51183) (elastic#51800) Query String(Bar) Input - cleanup (elastic#51598) (elastic#51804) [ML] Adjust and re-enable categorization advanced wizard test (elastic#51005) (elastic#51017) fixes url state tests (elastic#51746) (elastic#51798) fixes browser field tests (elastic#51738) (elastic#51799) [Task Manager] Tests for the ability to run tasks of varying durations in parallel (elastic#51572) (elastic#51701) [ML] Fix anomaly detection test suite (elastic#51712) (elastic#51795) [SIEM] Fix Timeline drag and drop behavior (elastic#51558) (elastic#51793)

…ra/kibana into IS-46410_remove-@kbn/ui-framework * 'IS-46410_remove-@kbn/ui-framework' of github.com:mbondyra/kibana: (49 commits) [ML] Re-activate after method in transform test (elastic#51815) [SIEM] [Detection Engine] Add edit on rule creation (elastic#51670) De-angularize visLegend (elastic#50613) [SIEM][Detection Engine] Change security model to use SIEM permissions [Monitoring] Sass cleanup (elastic#51100) Move errors and validate index pattern ⇒ NP (elastic#51805) fixes pagination tests (elastic#51822) Split legacy plugin discovery, expose SavedObjects scopedClient, wrappers, repository (elastic#48882) [SIEM][Detection Engine] Adds ecs threat properties to rules (elastic#51782) [Lens] Remove client-side reference to server source code (elastic#51763) Fix infinite redirect loop when multiple cookies are sent (elastic#50452) fixes drag and drop in tests (elastic#51806) [Console] Proxy fallback (elastic#50185) Query String(Bar) Input - cleanup (elastic#51598) shim visualizations plugin (elastic#50624) Expressions service fixes: better error and loading states handling (elastic#51183) fixes url state tests (elastic#51746) fixes browser field tests (elastic#51738) [ML] Fix anomaly detection test suite (elastic#51712) [SIEM] Fix Timeline drag and drop behavior (elastic#51558) ...

…license-management * 'master' of github.com:elastic/kibana: (48 commits) Enable alerting and actions plugin by default (elastic#51254) Fix error returned when creating an alert with ES security disabled (elastic#51639) [Discover] Improve Percy functional tests (elastic#51699) fixes timeline data providers tests (elastic#51862) [Dependencies]: upgrade react to latest v16.12.0 (elastic#51145) Allow routes to define some payload config values (elastic#50783) Move saved queries service + language switcher ⇒ NP (elastic#51812) [ML] Re-activate after method in transform test (elastic#51815) [SIEM] [Detection Engine] Add edit on rule creation (elastic#51670) De-angularize visLegend (elastic#50613) [SIEM][Detection Engine] Change security model to use SIEM permissions [Monitoring] Sass cleanup (elastic#51100) Move errors and validate index pattern ⇒ NP (elastic#51805) fixes pagination tests (elastic#51822) Split legacy plugin discovery, expose SavedObjects scopedClient, wrappers, repository (elastic#48882) [SIEM][Detection Engine] Adds ecs threat properties to rules (elastic#51782) [Lens] Remove client-side reference to server source code (elastic#51763) Fix infinite redirect loop when multiple cookies are sent (elastic#50452) fixes drag and drop in tests (elastic#51806) [Console] Proxy fallback (elastic#50185) ...

) Cookies are now checked for attributes that match the current Kibana configuration. Invalid cookies are cleared more reliably.

jportner added release_note:fix v7.6.0 v8.0.0 labels Nov 13, 2019

jportner commented Nov 13, 2019

View reviewed changes

src/core/server/http/cookie_session_storage.ts Outdated Show resolved Hide resolved

jportner commented Nov 13, 2019

View reviewed changes

jportner force-pushed the issue-36825-multiple-cookies branch from 70fcfe0 to f74e598 Compare November 13, 2019 20:17

jportner added the release_note:breaking label Nov 13, 2019

jportner requested a review from kobelb November 13, 2019 20:21

kobelb reviewed Nov 14, 2019

View reviewed changes

x-pack/plugins/security/server/authentication/index.ts Outdated Show resolved Hide resolved

Add extra validation checks for cookies

f75d72b

Cookies are now checked for attributes that match the current Kibana configuration.

jportner added 2 commits November 14, 2019 10:14

Remove secure attribute from session cookie value

4176916

We don't need to check this attribute, as it doesn't influence the scope of the cookie. Only `path` infleunces the cookie's scope.

Don't clear cookies with an undefined path in the session value

60d7789

jportner force-pushed the issue-36825-multiple-cookies branch from f74e598 to 60d7789 Compare November 14, 2019 15:34

jportner marked this pull request as ready for review November 14, 2019 15:37

jportner requested review from a team as code owners November 14, 2019 15:37

jportner requested a review from kobelb November 14, 2019 15:38

jportner added the Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! label Nov 15, 2019

pgayvallet reviewed Nov 16, 2019

View reviewed changes

jportner added v7.6.0 and removed v7.6.0 v8.0.0 labels Nov 21, 2019

jportner added v8.0.0 and removed release_note:breaking labels Nov 21, 2019

jportner changed the title ~~Add extra validation checks for cookies~~ Fix infinite redirect loop when multiple cookies are sent Nov 21, 2019

kobelb reviewed Nov 21, 2019

View reviewed changes

src/core/server/http/cookie_session_storage.ts Outdated Show resolved Hide resolved

x-pack/plugins/security/server/authentication/authenticator.test.ts Outdated Show resolved Hide resolved

x-pack/plugins/security/server/authentication/index.ts Outdated Show resolved Hide resolved

mshustov reviewed Nov 22, 2019

View reviewed changes

jportner added 2 commits November 22, 2019 09:17

Update parameter type on cookie validate callback

129d6b4

The validate callback can expect to receive ProviderSession or an array of ProviderSessions. The types have been updated to reflect that.

Address nits

c7f9e12

Merge branch 'master' of github.com:elastic/kibana into issue-36825-m…

16ad27c

…ultiple-cookies

kobelb approved these changes Nov 25, 2019

View reviewed changes

Merge branch 'master' of github.com:elastic/kibana into issue-36825-m…

85e51fd

…ultiple-cookies

pgayvallet approved these changes Nov 27, 2019

View reviewed changes

jportner merged commit 7830946 into elastic:master Nov 27, 2019

jportner mentioned this pull request Nov 27, 2019

[7.x] Fix infinite redirect loop when multiple cookies are sent (#50452) #51821

Merged

jportner deleted the issue-36825-multiple-cookies branch November 27, 2019 14:43

jportner added a commit that referenced this pull request Nov 27, 2019

Fix infinite redirect loop when multiple cookies are sent (#50452) (#…

108d973

…51821) Cookies are now checked for attributes that match the current Kibana configuration. Invalid cookies are cleared more reliably.

legrego mentioned this pull request Apr 22, 2020

[Security UI] Infinite Redirect Triggered when switching basePaths #17875

Closed

azasypkin mentioned this pull request Aug 20, 2020

login fail #74939

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix infinite redirect loop when multiple cookies are sent #50452

Fix infinite redirect loop when multiple cookies are sent #50452

jportner commented Nov 13, 2019 •

edited

Loading

jportner Nov 13, 2019

jportner Nov 13, 2019

jportner left a comment

elasticmachine commented Nov 13, 2019

elasticmachine commented Nov 13, 2019

elasticmachine commented Nov 13, 2019

kobelb left a comment

jportner commented Nov 14, 2019

elasticmachine commented Nov 14, 2019

elasticmachine commented Nov 15, 2019

pgayvallet Nov 16, 2019 •

edited

Loading

jportner Nov 16, 2019

pgayvallet Nov 17, 2019

mshustov Nov 22, 2019

jportner Nov 22, 2019

mshustov Nov 22, 2019

mshustov Nov 25, 2019 •

edited

Loading

jportner Nov 25, 2019

mshustov Nov 22, 2019 •

edited

Loading

jportner Nov 22, 2019

elasticmachine commented Nov 22, 2019

elasticmachine commented Nov 25, 2019

elasticmachine commented Nov 26, 2019

pgayvallet left a comment

	const isValid = (sessionValue: ProviderSession) => {
	// ensure that this cookie was created with the current Kibana configuration
	const { path, expires } = sessionValue;
	if (path !== undefined && path !== (http.basePath.serverBasePath \|\| '/')) {
	authLogger.debug(`Outdated session value with path "${sessionValue.path}"`);
	return false;
	}
	// ensure that this cookie is not expired
	return !(expires && expires < Date.now());
	};

	const authenticator = new Authenticator({
	clusterClient,
	basePath: http.basePath,
	config: { sessionTimeout: config.sessionTimeout, authc: config.authc },
	isSystemAPIRequest: (request: KibanaRequest) => getLegacyAPI().isSystemAPIRequest(request),
	loggers,
	sessionStorageFactory: await http.createCookieSessionStorageFactory({
	encryptionKey: config.encryptionKey,
	isSecure: config.secureCookies,
	name: config.cookieName,
	validate: (session: ProviderSession) => {
	const array: ProviderSession[] = Array.isArray(session) ? session : [session];
	for (const sess of array) {
	if (!isValid(sess)) {
	return { isValid: false, path: sess.path };
	}
	}
	return { isValid: true };
	},
	}),
	});

Fix infinite redirect loop when multiple cookies are sent #50452

Fix infinite redirect loop when multiple cookies are sent #50452

Conversation

jportner commented Nov 13, 2019 • edited Loading

Summary

Checklist

For maintainers

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jportner left a comment

Choose a reason for hiding this comment

elasticmachine commented Nov 13, 2019

💔 Build Failed

elasticmachine commented Nov 13, 2019

💚 Build Succeeded

elasticmachine commented Nov 13, 2019

💔 Build Failed

kobelb left a comment

Choose a reason for hiding this comment

jportner commented Nov 14, 2019

elasticmachine commented Nov 14, 2019

💚 Build Succeeded

elasticmachine commented Nov 15, 2019

pgayvallet Nov 16, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mshustov Nov 25, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mshustov Nov 22, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Nov 22, 2019

💔 Build Failed

elasticmachine commented Nov 25, 2019

💚 Build Succeeded

elasticmachine commented Nov 26, 2019

💚 Build Succeeded

pgayvallet left a comment

Choose a reason for hiding this comment

jportner commented Nov 13, 2019 •

edited

Loading

pgayvallet Nov 16, 2019 •

edited

Loading

mshustov Nov 25, 2019 •

edited

Loading

mshustov Nov 22, 2019 •

edited

Loading