can I discover another users LTPA2 token on the machine / in the browser?

If you put sit Paros on the traffic between your browser and a web application being hosted in WebSphere, you will have two session identifiers passed as part of the cookie section of the HTTP request:

A JSESSIONID. This is your HTTPSession ID as far as I can tell. An LTPA2 token. This is your “single sign on” session as far as websphere is concerned.

Now, IBM say that a single hosted application cannot invalidate the LTPA2 token when a user is signing out. The thinking behind this is that it is an SSO identifier, so a single application should not be able to invalidate it as it is intended for use across multiple applications. There is no configuration in WAS to declare “开发者_开发技巧this environment hosts only one application so therefore that app can invalidate the LTPA2 token”.

What is worrying is that these LTPA2 sessions hang around for a configurable amount of time. Therefore, if another user got a handle on a users’ LTPA2 token, they can use it to access that users’ session and therefore their sensitive data.

You can prevent a man in the middle attack to capture the session value by forcing the transmission of the cookie to occur over SSL, and by specifying HTTP only for cookies. However, I am still worried about the cookie being available on the local machines’ hard drive. The browser has to store it somewhere, so therefore there has got to be a way to get access to it?

My question is, is it possible for someone to get an LTPA2 value such as this from the hard drive? Say someone sits down in a library, signs in to their online banking, does some work and then logs out. Is it possible for the next user to get the LTPA2 token somehow?

I tried searching through the directories where I thought FireFox 4 and IE8 would store the cookie, but couldn’t pattern match the value. My gut instinct is that it may be possible to find this data on certain browsers?

By default the LTPA2 token is a "Session Cookie" Websphere does not set an expiry on that cookie, and it is just stored in Browser Memory until the user closes their browser.

Unless your client is explicitly manually pulling that cookie and storing it client side, it will not be stored in any files on the user's machine.

You can invalidate the LTPA token if you want to.

But this would require using IBM extensions (naturally)

Look at these:

(a) http://www.ibm.com/developerworks/websphere/techjournal/1003_botzum/1003_botzum.html

LTPA token is non-standard, but is simply a credential/token and does not impact the application development team. Redirects to the ibm_security_logout URL in order to remove the LTPA token when users log out.

(b) ftp://ftp.software.ibm.com/software/dw/wes/0409_botzum/WAS-511-Security-AdvancedTopics.pdf

Though these articles are old, these should still work (as these basics haven't changed a lot over the years)

By invalidating the LTPA token(which as Terrell mentioned in a "in memory session cookie" )all your worries that you had should be gone. HTH Manglu