mainSavannah Administration - Support: sr #109705, make session cookies httponly

 
 

sr #109705: make session cookies httponly

Submitter:  Peter Liscovius <peterdd>
Submitted:  Tue 11 Jun 2019 05:33:46 PM UTC
   
 
Category:  Savannah website Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Privacy:  Public Assigned to:  ineiev
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 17 Jun 2019 09:01:52 AM UTC, comment #1: 

Done.

Ineiev <ineiev>
Site Administrator
Tue 11 Jun 2019 05:33:46 PM UTC, original submission:  

The session_hash and session_uid are not httponly, which means javascript could read document.cookie

So easy fix might changing

setcookie($name, $value, $expiration, $path, $domain, $secure);

to

setcookie($name, $value, $expiration, $path, $domain, $secure, true);

in frontend/php/include/session.php

see https://www.php.net/manual/en/function.setcookie.php

Also the session cookies are .savannah.gnu.org, not savannah.gnu.org, so any subdomain tool has access to the session (I see it was intentional made, but is it used yet anywhere?)

While savannah.gnu.org has content-security-policy default 'self' which makes XSS harder, the subdomains like https://web.cvs.savannah.gnu.org have not, so a XSS there could read document.cookie

By setting the httponly option for session related cookies it would be a bit harder to exploit a XSS bug.

Peter Liscovius <peterdd>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #47075:  savane_cookies.png added by peterdd (241KiB - image/png)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by peterdd (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-06-17 ineiev CategoryNone Savannah website
        StatusNone Done
        Assigned toNone ineiev
        Open/ClosedOpen Closed
    2019-06-11 peterdd Attached File- Added savane_cookies.png, #47075

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code