Invalidate / Drop Domino HTTP Session?

2
votes

As far as I know it is not possible to invalidate or drop a specific (or multiple, say, based on a user name) Domino HTTP Session(s) (darn IMAP). Is there / what would be a proper workaround / mechanism to somehow drop / invalidate Domino HTTP Session(s)?

Some example cases could be:

  • Same user, two sessions, in one of those the user changes the HTTP Password (at this point all other sessions should be immediately invalidated). If he/she continues working / browsing in the other (browser)session (at some point) you get the "authentication failure using internet password" message on your console, and if you're in a bad luck the user gets locked out.
  • Facebook-style; have an overview of your current active sessions. One step further, if they see a suspicious session based on IP/Location, giving them control of invalidating it.
  • A client calls; "I got the feeling my session is hijacked".. First response; "you are a smart user, aren't ya?". Subsequently you want to drop those sessions with that user name (via console or "admin" web interface).
  • ...
1
httpsessionxpageslotus-domino
What did you try and what didn't work for you? For XPages, you can make use of custom PhaseListener (see devgrok.blogspot.cz/2009/07/… or jsftutorials.net/faces-config/phaseTracker.html) as an example. You would need to refer to docs.oracle.com/javaee/1.4/tutorial/doc/JSFIntro10.html as well, so you can know exactly when you want to do your checks. - Egor Margineanu
Thanks for the comment. We can indeed store the User Name and initialized SessionID's in a scoped map and validate against that map in the appropriate phase. But point is that the Sessions will still exist on the server. Case 3 for example; all is needed is an active (initialized) Session on the server and the created DomAuthSessId cookie to hijack a session. So in that case, (wishful thinking though) what needs to be done is; HttpSession.Destroy("user/sessionID's") or something like; tell http drop session <user/sessionID's> - Dalie
While your scenario is quite real, I don't actually see it as major risk, assuming you already applied all the security recommendations to your server. You can always track user's IP to his cookie. You can always disable web-access to all databases on server, except those you need to expose to web users. You don't need to have a Domino Directory exposed to perform authentication of users. You must always use SSL, so you can prevent MITM attacks. - Egor Margineanu

1 Answers

3
votes

You would have to take control of the authentication process, which could be done using the DSAPI interface that is described in the Notes C API documentation. I've only done some pretty minimal DSAPI work myself, but I understand from others who have worked with it extensively that advanced work with DSAPI is definitely not for the faint-hearted. You might want to look into some 3rd party products (e.g. from PistolStar) that may provide at least some of the functionality you are looking for.