Opened 58 minutes ago
#37440 new Cleanup/optimization
Clarify directory permission requirements for file-based sessions
| Reported by: | Sarah Boyce | Owned by: | |
|---|---|---|---|
| Component: | contrib.sessions | Version: | 6.1 |
| Severity: | Normal | Keywords: | not-security |
| Cc: | Triage Stage: | Unreviewed | |
| Has patch: | no | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
The file-based session backend includes the session ID in each session filename.
Hence, local users who can list the session directory can recover session IDs and could hijack authenticated sessions, even if they cannot read the files.
When SESSION_FILE_PATH is unset, Django uses the system’s temporary directory, which may be accessible to other local users.
The documentation currently mentions ensuring that the web server can read and write to the directory, but does not explain the need to restrict access by other users. The following docs should/could be updated to highlight this:
- https://docs.djangoproject.com/en/6.1/topics/http/sessions/#using-file-based-sessions
- https://docs.djangoproject.com/en/6.1/ref/settings/#std-setting-SESSION_FILE_PATH
Note that Django treats session storage as a trusted component, similar to the database and cache storage. Restricting access to that storage by untrusted local users is the deployer’s responsibility. Thank you "you yang" for the report.