Login Cookies Customize

Hi All,

Frappe has set its own SID and Path ‘/’
When I copy sid from Google console and paste it to another network console it works fine (i.e I copied from Google cookie sid and pasted in Firefox cookie) which causes the vulnerability
and path also “/” root which is not good practice

So I need a method or solution to override sid and path in cookies

Thanks for your attention

Hello,

Could you please explain the vulnerability? It seems to be working as expected.

The path is set to the root / since we don’t allow hosting any other applications on any paths.

If you have any more details, please feel free to contact us as per the details on Security

Thanks,
Akhil Narang

@akhilnarang Thanks for the reply

Step1: log in with one account in a system, copy the session id of the user from deveolper tool.

Step2: In another System intercept log in page request and put this session id in place of sid cookies.

Step3: It is observed that, from an unauthenticated system, we were able to log in using session id.

So when we copied sid from one system and pasted in another system login page, we are able to login which is called Session hijacking

Need soultion to prevent thia vulnerability…

Hello,

This requires the attacker to have access to a browser where you have logged in - they can directly perform malicious actions - no need of copying the token and using it in another browser.

If an attacker can extract the sid cookie externally without direct access to this system/browser, please let us know.

Thanks,
Akhil Narang