This document demonstrates the session-based authentication security implemented for the /useraccount endpoint.

The endpoint was vulnerable because:

1. No session management
2. credential_id was passed in form as hidden field
3. Anyone could POST with any credential_id to modify any user's profile

Example vulnerability:

# Attack: Modify user ID 2's profile without logging in
curl -X POST http://localhost:5000/useraccount \
  -d "credential_id=2&FirstName=Hacked&LastName=User"

This would have succeeded and modified the profile!

1. Session Management

   • Flask SECRET_KEY configured for secure sessions
   • User credentials stored in server-side session after login
   • credential_id never exposed to client

2. Authentication Check

   • All profile save requests verify session.get('logged_in')
   • credential_id retrieved from session, not form data
   • Unauthenticated requests redirect to /form4

3. Logout Functionality

   • /logout route clears session
   • Users can securely end their session

1. Login Flow:

   User submits login form at /form4 with username/password
   → POST to /useraccount with credentials
   → useraccountController.credentials_valid() validates
   → On success: session['logged_in'] = True
                  session['credential_id'] = user_id
                  session['username'] = username
                  session['user_level'] = 'admin' or 'employee'
   → Profile page rendered with user data
   

2. Profile Save Flow:

   User modifies profile and clicks Save
   → POST to /useraccount with action='save_profile'
   → Controller checks: session.get('logged_in')
   → If NOT logged in: redirect to /form4
   → If logged in: credential_id = session.get('credential_id')
                   (NOT from form data!)
   → Profile updated for authenticated user only
   

3. Logout Flow:

   User navigates to /logout
   → session.clear() removes all session data
   → Redirect to home page
   

1. Test authenticated access:

   • Login at /form4 with joe/doe
   • Modify profile and save
   • ✓ Should succeed with "Profile saved successfully!"

2. Test unauthenticated access:

   • Without logging in, try to POST to /useraccount
   • ✓ Should redirect to /form4 (login page)

3. Test session isolation:

   • Login as joe
   • Try to modify credential_id in browser DevTools
   • ✓ Session credential_id is server-side, can't be modified

4. Test logout:

   • Login, then visit /logout
   • Try to access /useraccount again
   • ✓ Should redirect to login (session cleared)

Files Modified:

• app.py: Added SECRET_KEY for session security
• controllers/useraccountController.py:
  • credentials_valid(): Sets session data on login
  • save_profile(): Uses session['credential_id'] instead of form data
  • run(): Checks authentication before allowing profile saves
• templates/user-account.html:
  • Removed credential_id hidden field
  • Added action='save_profile' to distinguish from login
• controllers/logoutController.py: New controller for session cleanup

✅ SECRET_KEY configured for session encryption ✅ Session data stored server-side (not in cookies) ✅ credential_id retrieved from session, not user input ✅ Authentication check before profile operations ✅ Redirect to login if not authenticated ✅ Logout functionality to clear sessions ✅ No sensitive data exposed in HTML/form fields

⚠️ SECRET_KEY should be changed and stored in environment variable ⚠️ Consider adding CSRF protection ⚠️ Consider adding session timeout ⚠️ Consider HTTPS-only session cookies ⚠️ Consider adding rate limiting to prevent brute force ⚠️ Consider adding "Remember Me" functionality with secure tokens

"""