Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OptOut requires a session (and therefore a PIWIK_SESSION cookie) #9812

Closed
JensGutermuth opened this issue Feb 20, 2016 · 3 comments
Closed

OptOut requires a session (and therefore a PIWIK_SESSION cookie) #9812

JensGutermuth opened this issue Feb 20, 2016 · 3 comments
Labels
Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it.

Comments

@JensGutermuth
Copy link

I would like to use piwik on my website without setting cookies, except the opt-out cookie. I added disableCookies in my tracker script and it works great.

There is one important exception though: The opt-out iframe sets a PIWIK_SESSION cookie. This session is used during the opt-out process to validate a nonce in https://github.com/piwik/piwik/blob/master/plugins/CoreAdminHome/OptOutManager.php#L183.

I removed this check and now filter the PIWIK_SESSION cookie in an upstream proxy as a workaround, but that doesn't seem "right".

Why is a nonce needed there at all? Why can't there be some URL that sets the ignore-cookie?

Alternatively: Would a nonce with some sort of cryptographic signature for validation work?
@tsteur
Copy link
Member

tsteur commented Feb 22, 2016

Without the nonce anyone could opt out your users. Eg an "attacker" could place a hidden iframe on another website and when a user opens a page there he would opt out of your site.

There might be better ways without a session but I haven't thought about it. Eg we could possibly generate and store a one-time "token" in database, and append it to the opt out URL. This would need to be implemented.

@tsteur tsteur added the Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. label Feb 22, 2016
@JensGutermuth
Copy link
Author

Very good point about a possible attack!

I quickly hacked a pair of functions together that will generate and validate a token based on time and the IP of the user. It doesn't need any database, but the tokens can be used multiple times by the same IP. I put it in a gist at https://gist.github.com/Delphinator/c4d74d52eb7abc3f8a24.

Would that work?

@tsteur
Copy link
Member

tsteur commented Feb 22, 2016

Something like this should work. The secret should be kind of random or depending on the user, otherwise it is either possible to calculate the secret from the token, or it is possible to calculate / guess the token.

For example if we used the salt, that is generated for each Piwik, one could calculate the salt as an attacker knows the valid_till and IP. This would be possible eg via brute force. This means the secret would need to be differently for each user and we would need to change it again over time, ideally. This means we need to store the "secret" somewhere. If we use session for this, we'll have a cookie again :)

@mattab mattab closed this as completed Mar 31, 2016
@mattab mattab added the wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it. label Mar 31, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tsteur @JensGutermuth @mattab