OAuth access token not invalidated on GitLab logout

Summary

The OAuth access token issued by GitLab to the gitlab-pages daemon (and stored in the gitlab-pages session cookie) is not invalidated when the user logs out of GitLab. The token, and therefore access to the protected Pages app, remains usable until the token's natural expiry (~2 hours).

This finding was identified during the AppSec review tracked in gitlab-com/gl-security/product-security/appsec/appsec-reviews#327 (T-02, Track 1: GitLab Pages Daemon).

Severity

Medium. The finding is reduced from a higher initial rating because of existing mitigations:

  • The cookie is HttpOnly.
  • The OAuth access token has a 2-hour expiry.
  • Scope of impact is limited to the affected user's access to Pages content.

Risk

A stolen gitlab-pages cookie (via XSS in a Pages app, machine compromise, or shared-device scenarios) remains usable after the user logs out of GitLab. Any sensitive data contained in a Pages app will be available to the attacker until the OAuth token in the cookie is invalidated (~2 hours).

A user logging out of GitLab reasonably expects that their active sessions and tokens, including those issued to downstream services like Pages, are revoked. Today they are not.

Test steps

  1. Attempt to access a Pages app while not authenticated on GitLab.

  2. Get redirected to authenticate on GitLab.

  3. Authenticate on GitLab.

  4. Get redirected back to the Pages app, now authenticated.

  5. Observe the gitlab-pages cookie has Max-Age=600 (10 minutes).

  6. Copy the gitlab-pages cookie value from the Pages app.

  7. Log out of GitLab.

  8. Use the following curl command, replacing the cookie header value and the URL for your page:

    curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: <INSERT PAGES DOMAIN>' \
    -b $'<INSERT COOKIE VALUE>' \
    $'https://<INSERT PAGES DOMAIN>'

Expected: request is rejected / re-authentication is required. Actual: request succeeds and the protected Pages content is returned.

Recommended remediation

Invalidate the OAuth access token (and the associated gitlab-pages session) when the user logs out of GitLab, so that Pages access cannot outlive the originating GitLab session. Options to consider include token revocation on GitLab logout, server-side session tracking that can be invalidated on logout, and/or shortening the effective lifetime of the Pages session to track GitLab session state more closely.

References