In T206010 there was some discussion about defense in depth measures against session stealing. In that proposal it was proposed to have a narrow interface so that mediawiki could not dump all sessions. But it was pointed out that that is probably an unrealistic attack strategy if the attacker can just create a new session for whatever user they want.
I'd like to propose that instead of directly storing the session id, we hmac the session id with $wgSecretKey. Thus making the link between the user cookie and the session data blob being one way.
This would be meant to prevent an attacker with the following capabilities from being able to impersonate other users:
- Attacker does not have access to mediawiki's PrivateSettings.php, but can read and write arbitrary keys to the backing store for sessions.
- Attacker had limited access to MediaWiki, but could not mount an active attack (perhaps time constraints or something) so decided to dump the session db and MW's secrets for later analysis and use in later attacks.
While these aren't the most pressing attack scenarios, given how easy this change would be with essentially no downsides, I think its worth it to do.
See also Tim's idea in T209556 to reduce risk around sensitive data stored in sessions.