Unit 1: Identities are the new perimeter · Lesson 2 of 4 · 20 min
How single sign-on works
Click through a real-looking sign-in, read the redirect and the cookies, and see which one an attacker would want.
mission
- You are
- You are the identity engineer explaining SSO to the shop team.
- Situation
- Shop admin uses Kestrel's identity provider. The team asks what actually happens between clicking the shop and seeing orders.
- Goal
- Follow the sign-in through each page and read the network panel.
- Hand in
- The client ID, the cookie the shop sets and how long it lasts.
Single sign-on as a hotel front desk
Open the shop without a session
Pick shop-admin.kestrel.example/ from the Pages list and open the Network panel.
you should see Status 302. The Location header sends you to login.kestrel.example with client_id, scope and redirect_uri.
Read the sign-in page
Open the authorize URL. The identity provider checks your password and asks for a number match.
you should see An idp_session cookie for login.kestrel.example, valid 12 hours (43200 seconds).
Follow the callback
Open the callback URL. The shop swaps a one-time code for its own session.
you should see Set-Cookie: shop_session with Max-Age=28800 and the Secure, HttpOnly and SameSite flags.
defender tip After this point the password is irrelevant. Whoever holds shop_session is signed in for 8 hours. That is why cookie theft beats MFA.
Compare with the warehouse portal
Open wms.kestrel.example/ and read its cookies.
you should see wms_sid lasts 30 days and has no Secure or HttpOnly flag.
Two session cookies
wms_sid=55aa13; Max-Age=2592000
30 days, readable by scripts, sent over plain HTTP.
shop_session=9d41f0c2; Secure; HttpOnly; SameSite=Lax; Max-Age=28800
8 hours, HTTPS only, hidden from scripts.
What a defender takes away
- 1SSO checks you once, then each app issues its own session.
- 2The session cookie, not the password, is what keeps you signed in.
- 3Short lifetimes and cookie flags limit what a stolen cookie is worth.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.