Session Cookie security questions

Question

I am a .NET developer but I also administer all of our corporate websites, which are all Wordpress. I inherited the sites from someone who is no longer at my company.

My company recently spent a bunch of money on a security audit by consultants and they found the following issues regarding login/cookie and how they work in Wordpress.

-User session cookies are not secure -session validation is not destroyed and is still active when a user logs out -session cookie includes the username in it

Is there any way do fix these issues?

Answer 1

The functions that generate, validate and clear auth cookies are all pluggable (meaning you can write your own versions of them). Just note that some of them may need to return something specific (like the user ID).

• wp_generate_auth_cookie() (generates your cookies)
• wp_set_auth_cookie (actually sets the cookies)
• wp_validate_auth_cookie() (validates your cookies)
• wp_parse_auth_cookie (parses an auth cookie, breaking it up into its component parts)
• wp_clear_auth_cookie (clear the auth cookies on logout)

One note: the cookies should, in fact, be destroyed when you log out. If they're not being destroyed, something is probably wrong. And "User session cookies are not secure" is pretty vague--you should ask for more input before you can conceptualize how to resolve this.

To solve your "session cookie includes username" problem, you could encrypt/obfuscate the value somehow before setting it, and decrypt it before running it through the auth check.