Hello,
I have a question for the Drupal community. We run a local news website on Drupal 8 and we also have classified ads for registered users on our website. I got an invitation to the court to testify in a case against a guy who was selling a mobile phone that was stolen. His lawyer (he) claims that someone else logged in to his account and published that classified ad. He says that he successfully logged in with his own username and got into someone others profile. For example, he logged in with JohnDoe username and password and actually got logged in as BusyBee. Is there any technical possibility for that kind of behavior?
In first few months after migration to D8 + Redis and CloudFlare we had problems with cache. In some very rare cases users reported that when they logged in, they saw another users avatar in their profile. But after few updates and some modifications to caching this problem seemed to disappear.
Thank you for your help.
Comments
He says that he successfully
Ok, but if someone want to sale the phone that he need to left contact phone. Whose phone was published in this ad?
Is it possible to reproduce this issue?
Is this open info? Is it possible that the lawyer read about that issue somewhere?
Probably it was a disposable
Probably it was a disposable phone number. I don't know details of the case, I just have to attend the court on Wednesday to testify or to clarify if it is possible that someone logged in as another user or not.
I never managed to reproduce it. We just got some users report.
I believe his lawyer know about this. It was stated in the comments on the website some time ago. But as far as I know, it was not that someone successfully logged into other users account, but it was only problem with cache.
Foreign User Rights impossible
Depending on your implementation, it can be possible that another username may be shown on occasions where you show it, whereas you would have insufficient cache contexts. Be sure to always add the user to the cache context (see Cache Contexts)
However it is impossible with Drupal Core that you log into an account and have the physical logged in properties and permissions of another user. The core functionality that performs the login is proven to be secure in millions of use cases and if such a problem existed, there would be a huge uproar in the Drupal community.
This means practically: You could be logged in as user A, but see content of user B because it was cached. However you will not be able to perform any user related actions as user B, these will all be performed under the user A account.
I had this issue once when I logged in as a regular user, I saw the Admin Toolbar of the system administrator with all links in it. However when clicking on any of these, I always got the forbidden message because the routes have permissions set and these get correctly validated no matter what happens on your frontend caching.
Great. This is something I
Great. This is something I was hoping to get here. Is there any documentation regarding this issue that is clearly saying (in not very tech language) that with wrong configuration it is possible that someone sees another users content, but cannot commit any actions with another users information?
I don't think there is a
I don't think there is a documentation on bad caching behavior. This is some sort of poor cache handling by the implementing programmer. This could lead to potential data leaks as if, for example I log into an user area and it shows me a dashboard with my personal information, this could also be poorly cached and therefore data could be shown to a user that has no access right to it. However, as stated before, operations have nothing to do with default Drupal caching (caching is only effective when rendering / passing content to the frontend) and updating the backend (access checks performed by Drupal, operations in the database) cannot be affected by caching mistakes.
Follow up...
Two days ago I testified on the court. Convict built his protection on the assumption that he did not post the content that was found problematic, but someone else did it with his username. He stated that he successfully logged in with his credentials and could use the website as another user.
He demonstrated it on the court, but we found out that he actually logged into his own account, but because of some caching issue, he saw another users avatar in the header of the website and link on the avatar was pointing to another users (public) profile. I tried to explain to the judge that it is just a caching issue and that it does not allow user to access another users private information or post any content with another users username. I proposed that we try to post anything on the website to support my statement and so we did and proved that it is not possible to post content as another user.
Anyway...we found a cache configuration issue on our site, but it did not reveal any private information to other users.
Thank you for your help!
Awesome!
Really glad that my hints helped you in court :-) drinking a beer on you tonight!
Anyway...we found a cache
Things work out for the best.