TechPrufer
Sign inGet started

Blogs›Shopify›Session Hijacking Protection

Session Hijacking Protection

Session Hijacking Protection

2
posts
2010–2020

This feature thread tracks the development and enhancement of security measures to protect user sessions from hijacking attacks. Initial efforts focused on addressing the threat posed by tools like Firesheep, which exploit insecure connections to steal session cookies. The primary solution implemented was the widespread adoption of SSL/TLS for all traffic within the Shopify admin area. This post details the evolution from manually provisioning TLS certificates to a fully automated system that supports over 1M business owners, including the development of the Notary system for automated provisioning and scaling, the integration of Let's Encrypt, and the migration to a cloud provider while maintaining the Notary infrastructure for resiliency.

2020

A Brief History of TLS Certificates at Shopify - Shopify

5/14/2020

This post details Shopify's journey in automating TLS certificate provisioning and management. It covers the initial manual provisioning for Shopify Plus, the development of the 'Notary System' for automated provisioning via API calls to certificate authorities, the scaling of this system using OpenResty and Lua for dynamic certificate loading from a database with LRU caching, and the resolution of mixed content warnings. It also discusses the adoption of Let's Encrypt and the subsequent migration to a cloud provider, including the decision to continue using the Notary system for both edge networks for synchronization simplification. Finally, it mentions the contribution of Lua middleware to the ingress-nginx Kubernetes project.

2010

Session Hijacking Protection - Shopify

11/23/2010

This post details the implementation of session hijacking protection at Shopify in response to the Firesheep vulnerability. It explains the technical details of HTTP session cookie hijacking and the limitations of relying solely on SSL for all traffic, particularly with custom merchant domains. The core technical contribution is the development of a custom `MultiSessionStore` for Ruby on Rails. This solution allows Shopify to enforce the use of secure cookies for backend administrative traffic (under *.myshopify.com) while still allowing for less secure cookies on the frontend, thereby mitigating the risk of session hijacking without requiring individual SSL certificates for every merchant's custom domain.