Session ID in zabbix url

[alj]

Please do not pass session ID via zabbix URL
I often have to give links to zabbix graphs to different people via mail.
It is kinda alot of extra work to discard SID from every URL i grab otherwise link will not work after session is expired.

Cookies are made for that.... Not URLs.

[Aly]

Ooh I see, and what the solution to CSRF could be?

[Alexei]

http://en.wikipedia.org/wiki/Cross-site_request_forgery

[alj]

Ooh I see, and what the solution to CSRF could be?

Well its ok if SID will be present in admin interface or where people edit stuff.
But simple link to the graph or screen should not have that IMO.
What is it there so critical to forge or steal?

Alternatively you can always check referrer for critical urls. If referrer domain is different than Host header then you simply reset session and redirect to login screen.

[Aly]

Well its ok if SID will be present in admin interface or where people edit stuff.
But simple link to the graph or screen should not have that IMO.
What is it there so critical to forge or steal?

Alternatively you can always check referrer for critical urls. If referrer domain is different than Host header then you simply reset session and redirect to login screen.

CSRF on any page could lead to unwanted results. A bet many admins wouldn't be glad if some commercial customers zabbix account will be hacked through small security hall.

FYI Referrer can't be trusted.

[alj]

CSRF on any page could lead to unwanted results. A bet many admins wouldn't be glad if some commercial customers zabbix account will be hacked through small security hall.

FYI Referrer can't be trusted.

Referrers can be trusted good enough.
If referrer is forged then this is NOT authenticated user browser so it doesn't have cookie you worry about.

Anyway if you don't want to clean up URLs what is the proper solution for users to send link to the publicly available graphs to each other?

I have no problem filtering SIDs but i had to explain this to users every time they tell me "your graphs are broken" when they try to forward link to somebody and session expires.

Also forwarding authenticated session to someone is probably even higher security risk than storing it in the cookie.
This is straight forward privilege escalation, another user opens url with SID and BAM - he is not himself anymore. How is that more secure than a cookie?

[Aly]

Referrers can be trusted good enough.
If referrer is forged then this is NOT authenticated user browser so it doesn't have cookie you worry about.

Referrer can be spoofed.

Anyway if you don't want to clean up URLs what is the proper solution for users to send link to the publicly available graphs to each other?

I have no problem filtering SIDs but i had to explain this to users every time they tell me "your graphs are broken" when they try to forward link to somebody and session expires.

There is no problem sending URL to the graph to someone else, SID doesn't checked with such request.
If users sessions expired, he will not see any zabbix page, because his is not loged In.

Also forwarding authenticated session to someone is probably even higher security risk than storing it in the cookie.
This is straight forward privilege escalation, another user opens url with SID and BAM - he is not himself anymore. How is that more secure than a cookie?

Did you checked this? I doubt.

[alj]

Referrer can be spoofed.

How exactly would you spoof Referrer and get cookie from user's browser at the same time?

There is no problem sending URL to the graph to someone else, SID doesn't checked with such request.
If users sessions expired, he will not see any zabbix page, because his is not loged In.
Did you checked this? I doubt.

Yes i did checked it now and apparently this is not an issue anymore.
Probably got fixed at some point /shrug
Sorry to waste your time.