Also though from a resource perspective it seems then I can

Question

Also though from a resource perspective it seems then I can re connect and just keep using the same session ID which is good considering that the default expiration for a session is 8hrs From a security perspective though if I can reuse the session ID and not have to auth then there should be additional protections in place like this session came from this IP addresss

wey · Answer

< Will Droste> Thanks for the great question I did some tests ```from import ConnectionPool from nebula3 Config import Config config = Config config max connection pool size = 10 connection pool = ConnectionPool client connecting to graphd connection pool init 127 0 0 1 9669 config from nebula3 gclient net AuthResult import AuthResult from nebula3 gclient net Session import Session session = connection pool get session root nebula session id = session session id simulate another client connecting to graphd2 connection pool2 = ConnectionPool connection pool2 init 127 0 0 1 49433 config connection = connection pool2 get connection auth result = AuthResult session id 0 b UTC session from evil = Session connection auth result connection pool True session from evil execute SHOW HOSTS it worked Out 28 ResultSet keys Host Port HTTP port Status Leader count Leader distribution Partition distribution Version values storaged0 9779 19779 ONLINE 9 basketballplayer 3 moviegraph 3 test 3 basketballplayer 3 moviegraph 3 test 3 3 3 0 storaged1 9779 19779 ONLINE 9 basketballplayer 3 moviegraph 3 test 3 basketballplayer 3 moviegraph 3 test 3 3 3 0 storaged2 9779 19779 ONLINE 12 basketballplayer 4 moviegraph 4 test 4 basketballplayer 4 moviegraph 4 test 4 3 3 0 In 31 session session id == session from evil session id Out 31 True In 32 session connection == session from evil connection Out 32 False``` gt So can you just pass in the `sessoinId` in to any connection The interface seems not yet allow passing at least from python client sessionID but it s actually totally doable as my test gt Is the session ID unique enough not be a security concern For instance if you make a connection to Nebula can somebody guess a `sessionId` just be doing `YIELD 1` statements Yes unfortunately this is doable I don t have security background this looks very bad or do you have any suggestions expected behaviors in such scenario gt Also though from a resource perspective it seems then I can re connect and just keep using the same session ID which is good considering that the default expiration for a session is 8hrs From a security perspective though if I can reuse the session ID and not have to auth then there should be additional protections in place like this session came from this IP addresss edited Yes the session to be persistent in metaD came with the intuition to enable cross client cross GraphD reuse auth context but as you mentioned maybe we should enable strict mode to optionally add verification of source IP etc on this

Will Droste · Answer

If we are to think of this like connecting to a web service the general security approach is this

Will Droste · Answer

Authenticate and return a token that one can not be guessed so for instance a JWT or some other PEM Its basically a encrypted signed piece of meta data Expire that token after a given set time provided in the meta data When a client attempts to use an expired token return an auth error so they can refresh it or create a new one

Will Droste · Answer

Basically you have a stateless service with a stateful token it should be encrypted or obfuscated such that it can t can be guessed and then the server should let the client know when it expires so they can create a new one And on each request validate the token to insure the client is authorized

Will Droste · Answer

Also I didn t see the ability to expire a `session` on the server side If there is an anomaly or too many sessions are created it would be good to have a command to expire particular ones as well as all of them

Will Droste · Answer

From the `thrift` interface the sessionId is passed here

Will Droste · Answer

``` final var resp = client executeWithParameter sessionId stmt getBytes UTF 8 parameterMap ```

Will Droste · Answer

Yes `optionally add verification of source IP etc on this ` that would be my first approach to this that a client must send the same session ID from the same IP In my mind it would be easy to add to the GraphService

wey · Answer

I moved this topic to <https github com vesoft inc nebula discussions 4874> slightly smiling face