WordPress.org
Get WordPress

Make WordPress Core

Opened 5 years ago

Closed 5 years ago

Last modified 5 years ago

#54569 closed feature request (invalid)

Test Cookie / Session Fixation

Reported by: scaryonly Owned by:
Priority: normal Milestone:
Component: Security Version:
Severity: minor Keywords:
Cc: Focuses: privacy

Description

A security audit found this: The application does not provide a fresh value for the cookie “wordpress_test_cookie” after a successful login. Although this cookie is not used in the session management mechanism, it is recommended to provide a fresh value for this cookie after a valid logon attempt.

Change History (4)

#1 @paapst
5 years ago

  • Focuses privacy added
  • Keywords needs-privacy-review added

The purpose of ​that cookie is just to check if cookies are enabled. Not sure why it would need a new value after a valid login attempt. Because if you would do that, wouldn't that also change or extend the purpose of the cookie?

This ticket was mentioned in ​Slack in #core-privacy by paapst. ​View the logs.
5 years ago

#3 @johnbillion
5 years ago

  • Milestone Awaiting Review
  • Resolution → invalid
  • Status new → closed

Thanks for the report @scaryonly but this is a false positive from your security scanning software. The value of this cookie is fixed and known. A session fixation vulnerability requires that the value is dynamic and associated with a user account, which this is not, therefore changing its value has no effect.

Regards and thanks.

#4 @paapst
5 years ago

  • Keywords needs-privacy-review removed
Note: See TracTickets for help on using tickets.