CODEWITHSUNDEEP
sessionspring-securitykeycloaksession-fixation
frumentum
frumentum

Reputation: 105

How to prevent session fixation with a Keycloak Spring Security setup?

We use keycloak as our identity and access provider that is connected with spring security by keycloak's spring security adapter. We realized that the session id does not change when a user logs in the application which is an open door for session fixation attacks. Both keycloak and spring security provide solutions for preventing session fixation but when I use both in combination none of them works properly.

From keycloak's documentation:

turn-off-change-session-id-on-login

The session id is changed by default on a successful login on some platforms to plug a security attack vector. Change this to true if you want to turn this off This is OPTIONAL. The default value is false.

I didn't turn off this feature but the session id still remains the same after login procedure.

Spring security comes along with two implementations of the SessionAuthenticationStrategy, ChangeSessionIdAuthenticationStrategy and SessionFixationProtectionStrategy, but none of them does the trick.

In the keycloak doku you can find a hint that "SessionFixationProtectionStrategy is currently not supported" but there is no advice how to deal with the session fixation risk in this setup. But according to this hint it should still be possible to change the session id with spring security with the consequence that "universal log out will not work" anymore. But even this I don't get to work (maybe we could go with the trade-off and lose the universal logout) I tried changing the session id with spring security on some ways (extraction of the configuration file):

  1. overwrite default session management filter by following this instructions
<http use-expressions="true" auto-config="false" entry-point-ref="keycloakAuthenticationEntryPoint">
[...]
     <!-- changeSessionId and newSession have no result at all -->
     <session-management session-fixation-protection="none"/>
     <session-management session-authentication-strategy-ref="sessionAuthenticationStrategy"/>
     <custom-filter ref="sessionManagementFilter" position="SESSION_MANAGEMENT_FILTER"/>
[...]
</http>
<beans:bean id="sessionAuthenticationStrategy"
        class="org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy"/>
<beans:bean id="sessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter">
        <beans:constructor-arg name="securityContextRepository" ref="securityContextRepository"/>
        <beans:constructor-arg name="sessionStrategy" ref="sessionAuthenticationStrategy"/>
</beans:bean>
  1. Overwrite default session management filter by this instruction
<http ...>
    <session-management session-authentication-strategy-ref="sessionStrategy"/>
</http>

<bean id="sessionStrategy" class="org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationSessionStrategy"/>
  1. Changing the behaviour of the default session management filter according to spring's documentation
<http use-expressions="true" auto-config="false" entry-point-ref="keycloakAuthenticationEntryPoint">
[...]
     <!-- changeSessionId and newSession have no result at all -->
     <session-management session-fixation-protection="changeSessionId"/>
[...]
</http>

Any hints are appreciated about preventing session fixation within a keycloak spring security environment.

Upvotes: 1

Views: 1965

Answers (0)

Related Questions