High security risk: Session Remains Valid After User Logout on Splunk SHC

Applicability

Description

- In the Search Head cluster, the Search Heads are logged in with SSO.
- Session cookie is getting generated, and then SH is logged out.
- Upon replaying the session cookie, it was found that the cookie is still valid, and results can still be obtained through the cookie, even though SH is logged out.

It was observed that this is happening only in the Search Head clustered environment, not on the Standalone SH.

On the standalone SH, when the session is active, validated that the cookie is alive as the user session is active.
Upon replaying the session cookie after logging out, it was observed that the cookie is not alive and does not return any results or any active information.

Note: The above observations were done on the "Burp Suite" tool.

Investigation

- Upon investigation, it was suggested to configure Session persistence to ensure that a user's requests are always sent to the same server during their session, which is important for applications that store session information locally on the server.

- By configuring the session persistence, each user is consistently routed to the same SH node throughout their session. Although session persistence is currently configured, it is recommended to verify the type of persistence used:

The preferred type is Cookie-based affinity or Client IP affinity, which ensures all requests for a given user session are routed to the same SH node, as this is critical for maintaining session consistency and enabling proper logout behavior.

However, even with sticky session enabled on the 3rd-party Load Balancer, the issue still exists.

The session cookie information is now stored on KVstore, which replicates the session cookie on all the SHC members as per design by default.

Resolution

This issue was persisting only for SHC because for SHC enabled environments, it is necessary to ensure the cookie is deleted after user logout.

This can be done by updating below parameter under #SPLUNKHOME/etc/system/local/server.conf :

[general]
invalidateSessionTokensOnLogout = true (default value is false)

- This is to be noted that the cookie refreshes by default in 30seconds, so to update that, the below parameter in #SPLUNKHOME/etc/system/local/server.conf should also be modified :

[general]
logoutCacheRefreshInterval = <nonnegative integer>[s|m|h|d]

Related Links

https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/Serverconf#:~:text=invalidateSessionTokensOnLogout%20%3D%20%3Cboolean%3E