Laravel - session data survives log-out/log-in, even for different users
In the laravel docs it says you can:
Removing An Item From The Session
Session::forget('key');
Removing All Items From The Session
Session::flush();
You could navigate to the AuthenticatesAndRegistersUsers.php trait and rewrite
/**
* Log the user out of the application.
*
* @return \Illuminate\Http\Response
*/
public function getLogout()
{
$this->auth->logout();
return redirect(property_exists($this, 'redirectAfterLogout') ? $this->redirectAfterLogout : '/');
}
to
/**
* Log the user out of the application.
*
* @return \Illuminate\Http\Response
*/
public function getLogout()
{
Session::flush();
$this->auth->logout();
return redirect(property_exists($this, 'redirectAfterLogout') ? $this->redirectAfterLogout : '/');
}
I have no idea if this actually work, but give it a try :)
Update
According to this answer here on Stack Overflow, you can set the session to expire on browser close, or after XXX minutes. Used together with the above solution, it should fix the problem?
In config/session.php
/*
|--------------------------------------------------------------------------
| Session Lifetime
|--------------------------------------------------------------------------
|
| Here you may specify the number of minutes that you wish the session
| to be allowed to remain idle before it expires. If you want them
| to immediately expire on the browser closing, set that option.
|
*/
'lifetime' => 120,
'expire_on_close' => false
Related videos on Youtube
JustAMartin
I'm just another programmer. Life forces me to behave like a full-stack developer, but I prefer to do the backend stuff more. And even more I'd prefer doing some uncommon stuff, such as developing low-level network, audio and wireless systems. Unfortunately, there are very few choices for such projects nearby and I have my bills to pay, so I mostly just go with the flow. BTW, I'm handicapped, I have vision issues since birth. It's serious enough to never being allowed to drive a vehicle. While I still can write some code I'm good, yay. Ok, you got me, I filled this section to get the StackOverflow Autobiographer badge. Are you happy now?
Updated on September 15, 2022Comments
-
JustAMartin over 1 year
Today I noticed something disturbing while inspecting session files in
storage/framework/sessions
folder created by Laravel 5.Here is what happened:
- I logged in as user A
- I navigated to a page which stores variable X in the Session
- I logged out, but did not close the browser.
- Session file in
storage/framework/sessions
was still there, and browser cookie was alive. - I logged in as user B.
- The old session file in
storage/framework/sessions
got deleted and a new session file was there. - I looked into the new session file - surprise! variable X has survived log-out and is still there, accessible for user B!
It leads to security concerns because now user B has access to the data of user A.
While debugging through Laravel source code, I found out that Session Store is never being cleared up during logout/login process. Only login credentials are being removed in
Illuminate\Auth\Guard::clearUserDataFromStorage()
method, but all the session Store attributes are still there, and then later when$kernel->terminate($request, $response);
is called, which in turn leads toIlluminate\Session\Middleware\StartSession::terminate()
callingStore::save()
, which blindly saves$this->attributes
to the new session, ignoring the fact that it now belongs to another user.From one hand, it seems logical - Laravel has no assumptions about my data and whether I want it to expire together with authentication or not. But it would be great to have it documented somewhere with a solution to attach some sensitive data to authentication object and expire together with it.
This means that I as a programmer am responsible for completely clearing away all the sensitive data from current session when a new (or the same) user is logging in.
Clearing on logging out would not be reliable, because user might never click Logout link but wait for the session to "expire", which for Laravel still does not clear up the session.
One more thing to keep in mind: I should not clear the session too early - there is AntiForgery token which must be present, or else login form will always fail.
I have found a forum topic which also tries to solve somewhat similar problem:
http://laravel.io/forum/04-27-2014-how-to-expire-session-data
I got confused by this:
I had another go at it today and realised what the problem was: Session::flush() does not delete session data that the app creates, such as the shopping cart details
If this is true, then the only way to get completely rid of session would be to use PHP native
session_unset()
andsession_destroy()
but I wouldn't want to go that way - I would prefer to find a cleaner, Laravel-ish solution, if possible.How do I tell Laravel that I want my old session data to be removed together with user authentication data when authentication expires or user logs out?
-
JustAMartin almost 9 yearsYes, this would work when user logs out on purpose. But in case if he just keeps browser open till session expires, I'll have to manually call those forget and flush functions. It seems, I'm not the only one who have discovered this potential security issue: github.com/laravel/framework/issues/8661
-
MartinJH almost 9 yearsUpdated the answer. Does that fix the issue for you?
-
JustAMartin almost 9 yearsYes, if the user closes the browser, then it always works fine and there is no issues at all. The problem is only if user just leaves and then much later another user comes and logs in - then old session variables are present. I guess, I'll have to live with those flush() calls during both logout and login, while there is no better built-in solution in Laravel to specify that I don't want some session variables to stay alive after session has changed.
-
MartinJH almost 9 yearsYeah, okay. I hope you'll find a better solution :) Or that laravel creates it
-
MartinJH almost 9 yearsBut if you worry about "much later", then why not set the expire time to something like 1-5 minutes? My bank logs me out after 10 minutes or so of inactive usage. But 2 minutes before auto logout they ask me if I want to renew/extend my session.
-
JustAMartin almost 9 yearsYes, that would work also, if customer will accept this idea. Some of them are stubborn and want neverending sessions, until browser is closed...