Bug 64930 - Option for not storing user-password in the session when "SitePassphrase" is set
Summary: Option for not storing user-password in the session when "SitePassphrase" is set
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_auth_form (show other bugs)
Version: 2.5-HEAD
Hardware: All All
: P3 enhancement (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-11-18 13:54 UTC by Sascha Bauer
Modified: 2020-11-18 13:54 UTC (History)
1 user (show)


Attachments
patch to implement "AuthFormDisablePwStore" directives and its function (3.52 KB, patch)
2020-11-18 13:54 UTC, Sascha Bauer 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sascha Bauer 2020-11-18 13:54:39 UTC 
Created attachment 37574 [details]
patch to implement "AuthFormDisablePwStore" directives and its function

Currently "mod_auth_form" has the possibility to set an "SitePassphrase". When "SitePassphrase" is set then mod_auth_form uses the SitePassphrase + user stored in the session for authentication instead user+password for every access - of course after a inital authentication with user+password.

So "mod_auth_form" does not have to store the user-password in the session after inital authentication when using "SitePassphrase", but it does.

For security-reasons it is a good idea to NOT storning the user-password in the session, when using "SitePassphrase". Especially when "mod_session_dbd" is used (to store session data on the server side) using a database which resists on the same machine as httpd, the server-admin can easily capture all passwords (even when using "mod_session_crypto").

My patch introduce a new directives for "mod_auth_form" called "AuthFormDisablePwStore". When "AuthFormDisablePwStore" is set to "On" (default "Off"), "mod_auth_form" will be prevented from storing the user-password in the session. If "AuthFormDisablePwStore" is set to "On" and "SitePassphrase" is NOT set, "AuthFormDisablePwStore" will be ignored.