Kyaw Ko Lwin's Blog: How to secure Classic ASP Session ID with JAVASCRIPT

To secure our websites, we need to secure our session ID. Although there are solutions for Asp.net and other programming languages, there isn't any solution for classic asp.

There is not any built-in features in classic asp to achieve that. So I have to invent my own way to secure it based on the available language's features and by adding some tweaks.

First of all, to secure the asp session ID, we need to change session ID after authentication and set two flags to asp session cookie, httponly and secure flags. Unfortunately, classic asp's session ID is read-only and we cannot set it directly from vbscript. And asp session ID is generated randomly, we need some tweaks to get both key and the value. Here are the steps:

Read current asp session id's key at login page.
When user login request is sent to authentication page, send this session key.
If the user is authorized, set invalid value to current session id and that will force the web server to generate new session id.
Redirect the page to new page to get a new session id.
Read new session id's key and value
Send new session id to new page
Add httponly and secure flag to new session id.

Step 1: Login page (login.asp).

<html>

<head>

function getSessionKey()

{

var c_name = "ASPSESSIONID";

if (document.cookie.length>0)

{

c_start=document.cookie.indexOf(c_name);

if (c_start!=-1)

{

c_end=document.cookie.indexOf("=",c_start);

if (c_end==-1) c_end=document.cookie.length;

return unescape(document.cookie.substring(c_start,c_end));

}

return "";

}

function submit()

{

document.login.sessionid.value = getSessionKey();

}

</script>

</head>

</form>

</body>

</html>

Here current session id will be read and will store it in the hidden field. When the form is submitted, this hidden value will also be sent.

Step 2: Authentication page (authenticate.asp).

<%
    'CODE for authorization/authentication
    '...
    
    'if login successful
    'delete the current session id to generate new one
    Response.AddHeader "Set-Cookie", Request("SessionID") & "=0"
    'redirect to another page to get new session id
    Response.Redirect "NewSession.asp"
%>

Here current session id will be read from the request's form field. Set invalid value to it and redirect to another page. When setting invalid value to Session ID, the web server will re-generate new session ID and will send it to the browser in subsequent response.

Step 3: Reading new session key (NewSession.asp)

<html>
<head>
<script type="text/javascript">
        
        function getCookie()
        {
         var c_name = "ASPSESSIONID";
         var cok;
        if (document.cookie.length>0)
          {
          c_start=document.cookie.indexOf(c_name);
          if (c_start!=-1)
            {
            //c_start=c_start + c_name.length+1;
            c_end=document.cookie.indexOf(";",c_start);
            if (c_end==-1)
            { 
                c_end=document.cookie.length;
                cok = unescape(document.cookie.substring(c_start,c_end) + ';');
            }
            else
            {
                cok = unescape(document.cookie.substring(c_start,c_end));
            }
            return cok;
            }
          }
        return "";
        }
        
        function submit()
        {
            document.login.sessionid.value = getCookie();
            document.login.submit();
        }
</script>
</head>
<body onload="submit()">
<form name="login" onsubmit="" action="UserAccount.asp">
<input type="hidden" name="sessionid" value="" />
</form>
</body>
</html>

Here new session id will be read from cookie and assign it to the hidden field. When the form is submitted, this hidden value will also be sent. In the next page, this new session ID will be retrieved and set two flags.

Step 4: Privileged page (UserAccount.asp).

<%
    Response.AddHeader "Set-Cookie", Request("SessionID") & "secure;httponly"
%>


<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
    <script type="text/javascript">        
        alert(document.cookie);
    </script>
</head>
<body onload="">
    ASP Session ID has been secured. :)
    <a href="session5.asp">visit</a>
</body>
</html>

Here current session id will be read from the request and append "secure" and "httponly" flags to them. By adding these two flags, session ID will only be sent to the client when using secure channel and session ID will no longer be accessible from client side javascript. This will prevent XSS (cross site scripting).

We are done!

Kyaw Ko Lwin's Blog

Thursday, December 23, 2010

How to secure Classic ASP Session ID with JAVASCRIPT

11 comments: