helpSavannah Administration - Support: sr #109705, make session cookies httponly

 
 

sr #109705: make session cookies httponly

Submitted by:  Peter Liscovius <peterdd>
Submitted on:  Tue 11 Jun 2019 05:33:46 PM UTC  
 
Category:  Savannah website Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Assigned to:  Ineiev <ineiev> Operating System:  None
Open/Closed:  Closed

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 17 Jun 2019 09:01:52 AM UTC, comment #1: 

Done.

Ineiev <ineiev>
Site AdministratorIn charge of this item.
Tue 11 Jun 2019 05:33:46 PM UTC, original submission:  

The session_hash and session_uid are not httponly, which means javascript could read document.cookie

So easy fix might changing

setcookie($name, $value, $expiration, $path, $domain, $secure);

to

setcookie($name, $value, $expiration, $path, $domain, $secure, true);

in frontend/php/include/session.php

see https://www.php.net/manual/en/function.setcookie.php

Also the session cookies are .savannah.gnu.org, not savannah.gnu.org, so any subdomain tool has access to the session (I see it was intentional made, but is it used yet anywhere?)

While savannah.gnu.org has content-security-policy default 'self' which makes XSS harder, the subdomains like https://web.cvs.savannah.gnu.org have not, so a XSS there could read document.cookie

By setting the httponly option for session related cookies it would be a bit harder to exploit a XSS bug.

Peter Liscovius <peterdd>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #47075:  savane_cookies.png added by peterdd (241KiB - image/png)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by peterdd (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-06-17 ineiev CategoryNone => Savannah website
        StatusNone => Done
        Assigned toNone => ineiev
        Open/ClosedOpen => Closed
    2019-06-11 peterdd Attached File- => Added savane_cookies.png, #47075

    Back to the top


    Powered by Savane 3.5