| Summary | shall we need a token for logout? |
| Queue | Horde Framework Packages |
| Queue Version | FRAMEWORK_3 |
| Type | Enhancement |
| State | Rejected |
| Priority | 1. Low |
| Owners | |
| Requester | dom.lalot (at) gmail (dot) com |
| Created | 06/08/2009 (5930 days ago) |
| Due | |
| Updated | 06/09/2009 (5929 days ago) |
| Assigned | |
| Resolved | 06/08/2009 (5930 days ago) |
| Milestone | |
| Patch | No |
without tokens! (bad idea..) Even if a CAS SSO server is able to know
which service has been used, it will have no idea of the token to
logout a user. We can just say: for that service, use that URL.
There will be a better patch to furnish a list of servers which are
autorized to logout whithout token. What do you think about?
image in an email pointing to a logout link. It's a denial of service
type of attack.
be rare.
I'll be obliged to leave with my patch and some others colleagues
without tokens! (bad idea..) Even if a CAS SSO server is able to know
which service has been used, it will have no idea of the token to
logout a user. We can just say: for that service, use that URL.
There will be a better patch to furnish a list of servers which are
autorized to logout whithout token. What do you think about?
Dom
State ⇒ Rejected
Patch ⇒ No
image in an email pointing to a logout link. It's a denial of service
type of attack.
Priority ⇒ 1. Low
New Attachment: login.patch
Patch ⇒ Yes
Milestone ⇒
Summary ⇒ shall we need a token for logout?
Type ⇒ Enhancement
State ⇒ New
Queue ⇒ Horde Framework Packages
page with iframes pointing to logout URLs
As there is now a token for logout action, we can't log out users.
I patched login.php:
Shall we consider that we must protect the logout form. What can be an
attack using logout form? For me: nothing..
root@ent1:/var/www/perso# diff -u -p horde/login.php.org horde/login.php
--- horde/login.php.org 2009-06-08 16:27:27.000000000 +0200
+++ horde/login.php 2009-06-08 16:26:51.000000000 +0200
@@ -60,12 +60,6 @@ if (($pos = strrpos($url_in, '#')) !== f
}
if ($logout_reason) {
- if (Auth::getAuth()) {
- $result = Horde::checkRequestToken('horde.logout',
Util::getFormData('horde_logout_token'));
- if (is_a($result, 'PEAR_Error')) {
- exit($result->getMessage());
- }
- }
$login_screen = $auth->getLoginScreen();
if (Util::getFormData('nosidebar') &&