Is sharing a dynamodb session table across many otherwise-isolated apps a security issue?

[trauts2]

We're considering giving separate deployments their own table within dynamodb to avoid customers in app 1 accidentally (or intentionally) gaining access to session data from another app that happens to use the same sessionid. Before we do, is this a realistic concern? Is it impossible or just unlikely?

Second, if we have to go this route, we'd like to keep the Beanstalk images the same. To override it dynamically I can see how the config.xml could be modified by a beanstalk .ebextensions file. But that feels really ugly. Is there a better way to tell a particular beanstalk environment to use a unique dynamodb table name?

Sorry, may not really an issue. Hope that's ok

[ceefour]

@trauts2 I use Spring Boot so this is how I do it:

import com.amazonaws.services.dynamodb.sessionmanager.DynamoDBSessionManager;
import org.apache.catalina.Context;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.context.embedded.EmbeddedServletContainerFactory;
import org.springframework.boot.context.embedded.tomcat.TomcatContextCustomizer;
import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;

import javax.inject.Inject;

/**
 * Configures {@link DynamoDBSessionManager} via:
 * * {@code server.session.dynamodb=true}
 * * {@code aws.access-key-id}
 * * {@code aws.secret-access-key}
 *
 * Note: Only sessions idle after 30 seconds is eligible to be stored.
 *
 * Hint: https://stackoverflow.com/a/33778218/122441
 *
 * Created by ceefour on 8/1/2017.
 */
@Configuration
public class TomcatConfig {

    private static final Logger log = LoggerFactory.getLogger(TomcatConfig.class);

    @Inject
    private Environment env;

    @Bean
    public EmbeddedServletContainerFactory servletContainerFactory() {
        TomcatEmbeddedServletContainerFactory factory = new TomcatEmbeddedServletContainerFactory();
        if (env.getProperty("server.session.dynamodb", Boolean.class, false)) {
            log.info("Setting DynamoDB SessionManager for Embedded Tomcat");
            factory.addContextCustomizers(new TomcatContextCustomizer() {
                @Override
                public void customize(Context context) {
                    final DynamoDBSessionManager dynamoManager = new DynamoDBSessionManager();
                    dynamoManager.setCreateIfNotExist(true);
                    dynamoManager.setAwsAccessKey(env.getRequiredProperty("aws.access-key-id"));
                    dynamoManager.setAwsSecretKey(env.getRequiredProperty("aws.secret-access-key"));
                    dynamoManager.setTable("app_" + env.getRequiredProperty("tenantEnv") + "_SessionState");

                    // Sanity configs
                    dynamoManager.setProcessExpiresFrequency(1); // Spring Boot's server.tomcat.background-processor-delay=30
                    dynamoManager.setSaveOnRestart(true);
                    dynamoManager.setMaxIdleBackup(30);

                    context.setManager(dynamoManager);
                    context.setDistributable(true);
                }
            });
        }
        return factory;
    }
}

[hyandell]

This project has been archived. Please see the README.md for more detail on alternative projects.