Security Review expectations on Logout Configuration

Question

Our app did not pass Security Review because "The logout function doesn't perform correctly the removal of session data server-side." Our application uses the popular Devise gem (Ruby on Rails) to handle authentication, and I verified that the logout action destroys the session cookie by following the steps under Testing for server-side session termination here: https://www.owasp.org/index.php/Testing_for_logout_functionality_(OTG-SESS-006)#How_to_Test.

There are no screenshots or examples provided in the security review report, so I can't really make sense of the specific issue that's being flagged.

One thing that might be relevant is that we are using the (encrypted) cookie as our session store, so the session cookie isn't invalidated after logout, it is only destroyed. And the logout button is visible on all pages as per the guidelines in the OWASP guide above. I didn't see any requirement in the Secure Coding guidelines that we needed to use a specific type of session store (e.g, database or cache server), only that we needed to handle authentication properly.

Can somebody from the Salesforce Security team help shed some light on the expectations here? Thanks very much!

Answer 1

This is not about seeing logout buttons in the UI after logging out, but expiring your session Id server-side. Expire means delete and don't re-use.

In your report, they should include a request/response pair. The way to test for this is to press the logout button in the UI and then replay an authenticated request, and compare the response to a response that was sent before the logout button was pressed. If you are getting the same response to the same cookies being sent, then this is a vulnerability, as logging out should invalidate the existing session ids and cause them to be rejected by the server.

Things like caching the cookies can be a source of problems, although there are no specific requirements about how you implement session management, only that it be implemented correctly. Just asking the client to delete cookies does not achieve your goals.

If you have more questions, you can book an office hour: https://security.secure.force.com/security/contact/ohours