X-Pack Authentication cookie replay possible even if logged out

[devdua]

Kibana version: - 7.x

Elasticsearch version: - 7.x

Server OS version: - CentOS 7

Browser version: - All browsers

Browser OS version: - All OS

Original install method (e.g. download page, yum, from source, etc.): - yum

Describe the bug:
Any process capturing requests from browser to Kibana can capture the session cookie and use it to submit authenticated requests to Kibana even if the user has logged out.

Steps to reproduce:

1. Login to Kibana
2. Using Dev Tools of the browser or using a plugin or interceptor like Burp, copy the "sid" cookie
3. Logout of Kibana
4. In another browser or in Private/Incognito mode, open Kibana. Add new cookie with key: sid and value as copied earlier.
5. Refresh the browser, you'll now be logged in as the user the cookie was generated for.

Expected behavior:
Apart from clearing session information on logout, there should be a way to invalidate cookies, maybe by using a server side cache of sessions which can be used to verify a cookie. These cookies or session cache data should get deleted on logout.

Screenshots (if relevant):
Step 2 -

Step 4 -

Step 5 -

Errors in browser console (if relevant):
No errors

Provide logs and/or server output (if relevant):
N.A.

Any additional context:

[elasticmachine]

Pinging @elastic/kibana-security

[kobelb]

Hey @devdua, thanks for bringing this up. This is actually a known limitation of the basic auth provider

The session cookies that are issued by the basic authentication provider are stateless. Therefore, logging out of Kibana when using the basic authentication provider clears the session cookies from the browser but does not invalidate the session cookie for reuse.

If you want this behavior, I'd recommend using the token auth provider

The session cookies that are issued by the token authentication provider are stateful, and logging out of Kibana invalidates the session cookies for reuse.

It's our intent to make the token auth provider the default starting in 8.0: #34339