Exposing encryptedSessionId leaks secret to database

[cameronmbell]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the bug has not already been reported

Fastify version

3.25.3

Plugin version

6.3.0

Node.js version

14.15.1

Operating system

Windows

Operating system version (i.e. 20.04, 11.3, 10)

10

Description

Compared to express session, fastify session exposes the encrypted session id to the database. This could be used to determine the session secret given a database leak and thus leaking temporary password equivalent. It also wastes space by including the sessionId twice and expiry date three times.

express-session

"_id":"abcdefghijklmnopqrstuvwxyz",
"expires":"2022-03-08T09:43:51.997+00:00",
"session":{
    "cookie":{
        "originalMaxAge":"5184000000",
        "expires":"2022-03-08T09:43:35.786+00:00",
        "secure":false,
        "httpOnly":true,
        "domain":null,
        "path":"/",
        "sameSite":null
    }
}

fastify/session

"_id":"abcdefghijklmnopqrstuvwxyz",
"expires":"2022-03-08T09:43:51.997+00:00",
"session":{
    "expires":"2022-03-08T09:43:51.997+00:00",
    "cookie":{
        "originalMaxAge":"5184000000",
        "expires":"2022-03-08T09:43:35.786+00:00",
        "secure":false,
        "httpOnly":true,
        "domain":null,
        "path":"/",
        "sameSite":"strict"
    },
    "sessionId":"abcdefghijklmnopqrstuvwxyz",
    "encryptedSessionId":"qwertyuiopasdfghjklzxcvbnm"
}

Steps to Reproduce

import fp from 'fastify-plugin';
import cookie from 'fastify-cookie';
import session from '@fastify/session';

// https://github.com/jdesboeufs/connect-mongo/issues/441
import _ from 'express-session';
import MongoStore from 'connect-mongo';

export default fp(async (fastify, options) => {
    if (!fastify.dbClient) {
        throw new Error('Must register db plugin');
    }

    fastify.register(cookie);
    fastify.register(session, {
        secret: process.env.SECRET,
        saveUninitialized: false,
        cookieName: '__Host-sessionId',
        cookie: {
            sameSite: 'strict',
            httpOnly: true,
            secure: false
        },
        store: MongoStore.create({
            stringify: false,
            client: /* ... */
        })
    });
});

Expected Behavior

Do not write encryptedSessionId to database.

[climba03003]

I don't think we can change how connect-mongo serialize and deserialize the session we passed inside.

https://github.com/jdesboeufs/connect-mongo/blob/master/src/lib/MongoStore.ts#L81-L103
https://github.com/jdesboeufs/connect-mongo/blob/master/src/lib/MongoStore.ts#L336-L401

[mcollina]

I think we can define encryptedSessionId using defineProperty and make it non-enumerable.

[mcollina]

@cameronmbell
Would you like to send a Pull Request to address this issue? Remember to add unit tests.

[cameronmbell]

Thank you for the quick reply. I'd really rather not, I can try if it's too much work for you, but it'll probably take me 10x the time it'll take you.

[m0dch3n]

I was encountering the same issue, so I corrected and committed a solution to my fork:

https://github.com/m0dch3n/session/commit/25dfa84af1424c3cf290632473df5d6ed4c0e391

[m0dch3n]

Also see my comment

[mcollina]

Would you like to send a PR?

[m0dch3n]

done...

[Uzlopak]

@rclmenezes

Here a unit test:

'use strict'

const test = require('tap').test
const { buildFastify, DEFAULT_OPTIONS } = require('./util')
const Store = require('../lib/store')

test('should save the session without sessionId and encryptedSessionId', async (t) => {
  t.plan(9)
  const storeMap = new Map()
  const fastify = await buildFastify((request, reply) => {
    request.session.someData = 'some-data'
    t.equal(request.session.someData, 'some-data')

    request.session.save((err) => {
      t.error(err)
      t.equal(storeMap.size, 1)
      const [sessionId, session] = [...storeMap.entries()][0]
      const keys = Object.keys(session)

      console.log(keys)
      t.ok(keys.includes('cookie'))
      t.equal(session.someData, 'some-data')
      t.ok(keys.length, 2)
      t.equal(keys.includes('sessionId'), false)
      t.equal(keys.includes('encryptedSessionId'), false)
    })
    reply.send()
  }, {...DEFAULT_OPTIONS, store: new Store(storeMap)})
  t.teardown(() => fastify.close())

  const response = await fastify.inject({
    url: '/'
  })

  t.equal(response.statusCode, 200)
})