Cookie data #229
Cookie data #229
Conversation
|
I think an Exception should be added to Cookie.php line 46 and i want to add the serverHasSecurity variable to pocketmine.yml or server.properties |
|
What to do in Cookie.php line 51 |
|
also this seems to be a memory leak if you never clean up the data. but this should be handled by the server instead; RakLib implements the protocol, not the server to handle the protocol. |
Co-authored-by: Jonathan Chan Kwan Yin <sofe2038@gmail.com>
|
They say MessageIdentifiers.php
|
Co-authored-by: Jonathan Chan Kwan Yin <sofe2038@gmail.com>
|
To avoid having to store all the cookies, I was wondering if it wasn't possible to use a predictable string based on the address and a server secret generated at start-up? Smth like a hash but for int ? |
src/protocol/OfflineMessage.php
Outdated
| @@ -46,4 +46,4 @@ protected function writeMagic(BinaryStream $out){ | |||
| public function isValid() : bool{ | |||
| return $this->magic === self::MAGIC; | |||
| } | |||
| } | |||
| } | |||
There was a problem hiding this comment.
fwiw, by linux and git conventions, text files should have a trailing newline.
src/server/Server.php
Outdated
| // If you don't want to use security on the server, just delete this line. | ||
| $this->cookie = new Cookie(); |
There was a problem hiding this comment.
Users of the library don't want to change the library itself to change a behavior, a switch in the constructor need to be created
I previously considered this. I don't think a static secret for the whole server runtime is wise (attackers could collect cookies and reuse them), but we could have the secret periodically rotated (similar to how GS4 Query operates in PM). A mechanism like that might be problematic for proxies, though, since they don't see the real IP of the client. |
|
@dktapps why would proxies be a problem? unless some packets are not sent through the proxy |
|
because proxy sees only 1 IP address for all clients
|
|
Why is this PR closed? |
I'd say it's the responsibility of the proxy to override the cookie field. |
I couldn't find any solution. |
|
it is better for security that the cookie feature is always on |
Im not completely sure of the code i wrote. Please add/subtract and report my mistakes. We need to update this