search

PHSCDC / itocdc-2015-www

An insecure PHP web app for the Iowa State University 2015 IT Olympics Cyber Defense Competition (ITOCDC)
MIT License
0 stars 1 forks source link

Finicky session handler #65

Closed ngiddings closed 9 years ago

ngiddings commented 9 years ago

The session handling system behaves strangely. I'm not sure how else to describe this. My experience in as follows:

I login and am redirected to the homepage as an authenticated session. After clicking a single like, I am logged out. I go to log back in, and I get a message saying 'Already logged in elsewhere'. After trying again I can log in, and the session behaves as expected.

ngiddings commented 9 years ago

After properly logging out and logging back in again, I got a 'Logged in elsewhere' error the first time. It seems to take two attempts to log in at all.

majiru commented 9 years ago

This is due to session sickness with the load balancer, this can be resolved with a small use of cookies via haproxy

majiru commented 9 years ago

Session Sickness is now fixed, HAProxy now locks a user to one server for 60m at a time.