Systems and methods for preventing session fixation over a domain portal
In one embodiment, a method includes a system receiving a request from a user's device, the request being directed to a first host. The system may generate a key, a verification token, and an encrypted key. The system may transmit the verification token and the encrypted key to the device from the first host, and transmit instructions configured to cause (1) the verification token to be stored as a cookie associated with the first host, and (2) the device to transmit the encrypted key to a second host. The system may receive a second request comprising the encrypted key from the device, and decrypt it to obtain the key upon determining that the encrypted key was not previously decrypted. The system may transmit the key to the device from the second host, and instruct the device to store the key as a cookie associated with the second host.
1. A method comprising:
by a computing system, receiving a first request from a client device associated with a user, the first request being directed to a first host associated with the computing system;
by the computing system, generating a key in response to the first request;
by the computing system, generating a verification token based on the key;
by the computing system, generating an encrypted key based on the key;
by the computing system, transmitting first instructions, the verification token, and the encrypted key to the client device from the first host associated with the computing system, the first instructions being configured to:
cause the verification token to be stored as a first cookie on the client device, the first cookie being associated with the first host; and
cause the client device to transmit the encrypted key to a second host associated with the computing system;
by the computing system, receiving a second request comprising the encrypted key from the client device;
by the computing system, decrypting the received encrypted key to obtain the key upon determining that the encrypted key was not previously decrypted; and
by the computing system, transmitting second instructions and the key obtained from the decryption to the client device from the second host, the second instructions being configured to cause the key obtained from the decryption to be stored as a second cookie on the client device, the second cookie being associated with the second host.
2. The method of claim 1 , further comprising:
by the computing system, receiving from the client device a prior request, wherein the prior request is directed to a third host associated with the computing system and is received before the first request is received; and
by the computing system, transmitting a redirection instruction to the client device in response to the prior request, the redirection instruction being configured to cause the client device to send the first request to the first host.
3. The method of claim 1 , further comprising:
by the computing system, generating a nonce; and
by the computing system, transmitting the nonce to the client device;
wherein the first instructions is configured to cause the client device to transmit the nonce with the encrypted key to the second host associated with the computing system; and
wherein the determining that the encrypted key was not previously decrypted is based on the nonce.
4. The method of claim 3 , further comprising:
by the computing system, receiving a third request from a second client device associated with a second user, the third request comprising the encrypted key and the nonce;
by the computing system, determining that (1) the nonce was previously used or (2) the nonce is not bound to the encrypted key; and
by the computing system, rejecting the third request.
5. The method of claim 1 , wherein the first cookie is configured to be accessible by client-side scripts, wherein the second cookie configured to be inaccessible by client-side scripts.
6. The method of claim 1 , wherein the first host and the second host are different.
7. The method of claim 1 , wherein the second host is configured to provide access to a web page hosted by a third-party.
8. The method of claim 1 , further comprising:
by the computing system, receiving a third request from the client device comprising the key stored as the second cookie;
by the computing device, generating a second verification token based on the key received with the third request; and
by the computing device, transmitting a web page in response to the third request to the client device, the web page comprising the second verification token and instructions configured to cause the client device to:
compare the second verification token with the verification token stored as the first cookie; and
determine whether to render the web page based on the comparison.
9. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:
receive a first request from a client device associated with a user, the first request being directed to a first host associated with a computing system;
generate a key in response to the first request;
generate a verification token based on the key;
generate an encrypted key based on the key;
transmit first instructions, the verification token, and the encrypted key to the client device from the first host associated with the computing system, the first instructions being configured to:
cause the verification token to be stored as a first cookie on the client device, the first cookie being associated with the first host; and
cause the client device to transmit the encrypted key to a second host associated with the computing system;
receive a second request comprising the encrypted key from the client device;
decrypt the received encrypted key to obtain the key upon determining that the encrypted key was not previously decrypted; and
transmit second instructions and the key obtained from the decryption to the client device from the second host, the second instructions being configured to cause the key obtained from the decryption to be stored as a second cookie on the client device, the second cookie being associated with the second host.
10. The media of claim 9 , wherein the software is further operable when executed to:
receive from the client device a prior request, wherein the prior request is directed to a third host associated with the computing system and is received before the first request is received; and
transmit a redirection instruction to the client device in response to the prior request, the redirection instruction being configured to cause the client device to send the first request to the first host.
11. The media of claim 9 , wherein the software is further operable when executed to:
generate a nonce; and
transmit the nonce to the client device;
wherein the first instructions is configured to cause the client device to transmit the nonce with the encrypted key to the second host associated with the computing system; and
wherein the determining that the encrypted key was not previously decrypted is based on the nonce.
12. The media of claim 11 , wherein the software is further operable when executed to:
receive a third request from a second client device associated with a second user, the third request comprising the encrypted key and the nonce;
determine that (1) the nonce was previously used or (2) the nonce is not bound to the encrypted key; and
reject the third request.
13. The media of claim 9 , wherein the second host is configured to provide access to a web page hosted by a third-party.
14. The media of claim 9 , wherein the software is further operable when executed to:
receive a third request from the client device comprising the key stored as the second cookie;
generate a second verification token based on the key received with the third request; and
transmit a web page in response to the third request to the client device, the web page comprising the second verification token and instructions configured to cause the client device to:
compare the second verification token with the verification token stored as the first cookie; and
determine whether to render the web page based on the comparison.
15. A computing system comprising:
one or more processors; and
one or more computer-readable non-transitory storage media coupled to one or more of the processors and comprising instructions operable when executed by one or more of the processors to cause the system to:
receive a first request from a client device associated with a user, the first request being directed to a first host associated with the computing system;
generate a key in response to the first request;
generate a verification token based on the key;
generate an encrypted key based on the key;
transmit first instructions, the verification token, and the encrypted key to the client device from the first host associated with the computing system, the first instructions being configured to:
cause the verification token to be stored as a first cookie on the client device, the first cookie being associated with the first host; and
cause the client device to transmit the encrypted key to a second host associated with the computing system;
receive a second request comprising the encrypted key from the client device;
decrypt the received encrypted key to obtain the key upon determining that the encrypted key was not previously decrypted; and
transmit second instructions and the key obtained from the decryption to the client device from the second host, the second instructions being configured to cause the key obtained from the decryption to be stored as a second cookie on the client device, the second cookie being associated with the second host.
16. The system of claim 15 , wherein the processors are further operable when executing the instructions to:
receive from the client device a prior request, wherein the prior request is directed to a third host associated with the computing system and is received before the first request is received; and
transmit a redirection instruction to the client device in response to the prior request, the redirection instruction being configured to cause the client device to send the first request to the first host.
17. The system of claim 15 , wherein the processors are further operable when executing the instructions to:
generate a nonce; and
transmit the nonce to the client device;
wherein the first instructions is configured to cause the client device to transmit the nonce with the encrypted key to the second host associated with the computing system; and
wherein the determining that the encrypted key was not previously decrypted is based on the nonce.
18. The system of claim 17 , wherein the processors are further operable when executing the instructions to:
receive a third request from a second client device associated with a second user, the third request comprising the encrypted key and the nonce;
determine that (1) the nonce was previously used or (2) the nonce is not bound to the encrypted key; and
reject the third request.
19. The system of claim 15 , wherein the second host is configured to provide access to a web page hosted by a third-party.
20. The system of claim 15 , wherein the processors are further operable when executing the instructions to:
receive a third request from the client device comprising the key stored as the second cookie;
generate a second verification token based on the key received with the third request; and
transmit a web page in response to the third request to the client device, the web page comprising the second verification token and instructions configured to cause the client device to:
compare the second verification token with the verification token stored as the first cookie; and
determine whether to render the web page based on the comparison.