SSO is secure ?

[Migrated From Jforum.net]

http://www.jforum.net/doc/SSOCookies
This link writes about SSO but

2 Cookie cookie = new Cookie("JforumSSO", user.getUsername());
3 cookie.setMaxAge(-1) // session cookie, or set to positive number.
4 response.addCookie( cookie );


Everybody can make fake cookie to enter website as someone others account.
Maybe I'm wrong for that but as far as i know hotmail has had a security hole like that too before...
When user clicks on some link on hotmail window , attacker access his account for free
There is no security for that ? :roll:

By the way , i m using
SSOCookies.java for sso
[originally posted on jforum.net by kadirbasol]

[Migrated From Jforum.net]

Good security point. But was meant as a simple example of how to write your own SSO Cookie based implementation and not how to create a secure cookie. SSO implementators need to consider what level of security they need to build in.

For example, the value of the cookie should be some sort of encrypted string that identifies the specific PC and user. This means that even if someone "hijacks" your cookie, they can't use it.

Of course, if you need high security, you should be using SSL with Cookies as well.
[originally posted on jforum.net by monroe]

[Migrated From Jforum.net]

When i set Cookie from my outside jsp application

2 Cookie cookie = new Cookie("JforumSSO","JDuke"); 
3 cookie.setMaxAge(-1) // session cookie, or set to positive number. 
4 response.addCookie( cookie );

Redirect user to jforum will create new username "JDuke" if user doesnt exists.
Also with default password on sso and default mail.Right ?
if user already exists , he will login as JDuke.
As i understood sso ...

Here is my CookieUserSSO :

package net.jforum.sso;

import javax.servlet.http.Cookie;
import net.jforum.context.RequestContext;
import net.jforum.JForumExecutionContext;
import net.jforum.ControllerUtils;
import net.jforum.entities.UserSession;
import net.jforum.util.preferences.ConfigKeys;
import net.jforum.util.preferences.SystemGlobals;
import org.apache.log4j.Logger;
//JForumExecutionContext.getRequest()
//JForumExecutionContext.getRequest().getSession()
public class CookieUserSSO implements SSO {

	static final Logger logger = Logger.getLogger(CookieUserSSO.class.getName());

	public String authenticateUser(RequestContext request) {		
		// myapp login cookie, contain logged username
		Cookie myCookie = ControllerUtils.getCookie(SystemGlobals.getValue(ConfigKeys.COOKIE_NAME_USER));
		String username = null;
		
		if (myCookie != null) {
			username = myCookie.getValue();
		}
		return username; // jforum username
	}

	public boolean isSessionValid(UserSession userSession, RequestContext request) {
		Cookie SSOCookie = ControllerUtils.getCookie( SystemGlobals.getValue(ConfigKeys.COOKIE_NAME_USER )); // myapp login cookie		
		String remoteUser = null;
		
		if (SSOCookie != null) {
			remoteUser = SSOCookie.getValue(); //  jforum username
		}
		
        // user has since logged out
        if(remoteUser == null && userSession.getUserId() != SystemGlobals.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) {
			return false;
        // user has since logged in
        } else if(remoteUser != null && userSession.getUserId() == SystemGlobals.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) {
            return false;
        // user has changed user
        } else if(remoteUser != null && !remoteUser.equals(userSession.getUsername())) {
            return false;
        }
        
        return true; // myapp user and forum user the same
	}
}

[originally posted on jforum.net by kadirbasol]