HttpUseridModule lacks uniqueness in uid generation

[Patrick Ellul]

Looking at the C code of this module, it seems that the UID generation is based on 4 things in order:

1) local_sockaddr
2) ngx_time
3) start time of nginx
4) sequence

However, these values are converted to uint32 before being htonl'ed.

Then they are sprintf'ed using %08XD

Also the resultant cookie is trimmed to 22 characters.

This means that the assigned uid is not very unique, not to mention quite predictable.

When using this uid for session management, it makes it possible for users to intrude on other users sessions, perhaps even steal another user's session on purpose.

We discovered this from our production systems, when we noticed that the same uid was being given to hundreds of different clients.

The nature of our system is such that we receive massive bursts of requests in a small amount of time and hence the chance of this happening increases quite a lot.

A simple fix could be to use a long random string instead, possibly of configurable length.

[Maxim Dounin]

UID generated is 128 bit number, and it is generated in a way which provides uniqueness for up to 2¹²⁸ cookies for a single domain as long as properly configured (note that you are responsible for proper userid_service assignment if multiple servers with the same ip address are used, see ​docs and original ​mod_uid apache module documentation for details).

The module was never meant to provide unpredictable values, it's design goal is different. See original ​mod_uid apache module documentation, it has many details explaining why it works this way and how it's expected to be used.

[Patrick Ellul]

Thank you for your prompt reply.

I looked at the references but I could not find an explanation why the length is trimmed to 22 characters. Since the sequencer is the final 32 bits, potentially it might be trimming the most significant bits.

Replying to Maxim Dounin:

UID generated is 128 bit number, and it is generated in a way which provides uniqueness for up to 2¹²⁸ cookies for a single domain as long as properly configured (note that you are responsible for proper userid_service assignment if multiple servers with the same ip address are used, see ​docs and original ​mod_uid apache module documentation for details).

The module was never meant to provide unpredictable values, it's design goal is different. See original ​mod_uid apache module documentation, it has many details explaining why it works this way and how it's expected to be used.

[Ruslan Ermilov]

Replying to Patrick Ellul <pellul@ipowow.com>:

Thank you for your prompt reply.

I looked at the references but I could not find an explanation why the length is trimmed to 22 characters. Since the sequencer is the final 32 bits, potentially it might be trimming the most significant bits.

UID is 128 bit entity.
128 bits == 16 bytes
16 bytes encoded in Base64 gives you 22 characters.