I am working on porting bjaspan's excellent patch to 5.x:
http://drupal.org/node/66970

Without this countermeasure against session hijacking, the protection afforded by securepages is easily bypassed.

CommentFileSizeAuthor
#5 securepages-284132-5.patch8.66 KBcedarm
#1 securepages-hijack.patch4.08 KBgrendzy

Comments

grendzy’s picture

grendzy commented
StatusFileSize
new securepages-hijack.patch4.08 KB

OK, here is my port to 5.x-1.6.

I made one improvement from the 4.7 version: the cookie parameters are copied in from the current session. This is mainly useful in setting the expiry time to match the session cookie, which prevents false positives which used to happen if the secure cookie expired before the session cookie.

grendzy’s picture

grendzy commented
Status: Patch (to be ported) » Needs review
christefano’s picture

christefano commented

Thanks, grendzy. I'm testing this now on a few sites.

bjaspan’s picture

bjaspan commented

subscribe

cedarm’s picture

cedarm commented
StatusFileSize
new securepages-284132-5.patch8.66 KB

Incorporated changes to D6 patch (#286499-7: (D6) Preventing hijacked sessions from accessing SSL page, comments #5, 6, 7) into this patch. This includes the hook_requirements() in securepages.install.

This applies to securepages 5.x-1.7-beta1.

grendzy’s picture

grendzy commented
Status: Needs review » Fixed

securepages_prevent_hijack is now available for D5, which provides this enhancement as a module.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.