Security issue with my site

[Portman]

Hi,

I noticed on my site if I share a link with someone and stay logged in when they open the link they also are logged into my account, if I am logged out, then so are they when they click the link - I checked the security settings on my site (admin/tools/security checks) and noticed that allow_url_fopen was disabled - so I enabled that on cpanel - when I go to security check however it still says it is disabled - I have contacted my host about this. in the mean time, the security issue persists.

Is this the setting that is causing my security issue or is it something else? I am runing v1.0.8.20 for this issue.

Thanks

[ecartz]

Is this the setting that is causing my security issue or is it something else?

Something else. As far as I know, the software works without allow_url_fopen (it's required for legacy reasons; we could probably remove that requirement now) -- regardless, that wouldn't have anything to do with this.

The most straightforward solution is to Force Cookie Use, which will move the session ID out of the URL. In general, there are several settings in admin > Configuration > Sessions that can help with that problem, although they all have downsides.

[burt]

What sort of link are you sharing?
Is it a simple link such as "yourshop.com"?
Or maybe "yourshop.com/product_info.php?products_id=123"
Or maybe some type of URL rewriting (that ends up on a product page)
Or are you sharing a link with a session id?

HOw are you sharing the link?
Email? Social Icons? Something else ?

Where are you sharing it?
Twitter? Facebook? With a customer by email? Something else?


We needs LOADS more detail as to what you are doing.

You could even share a link here and people can visit and let you know if they are logged in or not.

[Portman]

The issue was that a customer shared the entire URL (with session id) of a product with a group of people (I think on social media) and when they clicked on it they were logged into the original customers account.

I then tested it with my own accounts and discovered that this is a potential problem.

I understand that if I log out the session id is no longer valid but this is not the case for customers like in the example above.

So is there some way to make it so that the session id cannot be shared?

[ecartz]

So is there some way to make it so that the session id cannot be shared?

Yes. Force Cookie Use.

Also, any of the Session settings that check if it's the same person. However, doing those has the side effect of not allowing some rare case where the same person has two different values for those.