600394 - Use HTTPOnly Flag to Protect Cookie Values

Status: RESOLVED FIXED

(support.mozilla.org :: General, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

None of the cookies are not using the HTTPOnly flag (most notable the token cookies and custcare_access). This flag serves as a
secondary protection to prevent session hijacking in the case of XSS attacks.

Steps to reproduce:
1. Login
2. Enter the following JavaScript into the URL
javascript:document.write(document.cookie);document.close();
3. All printed cookies are not using the HTTPOnly flag

This will not necessarily show all of the cookies since some of the cookies may have been cleared.  Inspecting the set-cookie headers within the HTTP Response for each cookie will show whether the value "HTTPONLY" has been set.


Recommended Remediation
Whenever a cookie is set also set the HTTPOnly flag. This will instruct the
browser to not allow JavaScript access to the cookie.

Comment 1

[Alex Buchanan [:abuchanan]]

I haven't read this whole ticket, but if I understand correctly, setting the HTTPOnly flag isn't currently supported by Django.

http://code.djangoproject.com/ticket/3304

There might be a workaround, just pointing out that we'll have to find one ;)

Comment 2

[Michael Coates [:mcoates] (acct no longer active)]

I read through the ticket. It looks like support has been added for python and there are several patches or middleware examples to get it working in django.  Whatever we decide to do, let's add that into our commonware.

Comment 3

[James Socol [:jsocol, :james]]

There is an example of middleware that could be adapted for Python 2.6[1], though I'm not sure what license it's under.

[1] http://code.google.com/p/pageforest/source/browse/appengine/utils/cookies.py

Comment 4

[Alex Buchanan [:abuchanan]]

(In reply to comment #3)
> There is an example of middleware that could be adapted for Python 2.6[1],
> though I'm not sure what license it's under.
> 
> [1]
> http://code.google.com/p/pageforest/source/browse/appengine/utils/cookies.py

Looks like the project owner is the same that posted on the django ticket, so I'm guessing they're OK with people using it.  I've sent an email to confirm.

I still need to look at the code and understand how it works, but seems like we can do this for 2.2.5

Comment 5

[James Socol [:jsocol, :james]]

I think you'll need to update that code for Python 2.6, and this should be part of commonware. I'll add you as a collaborator if you aren't already.

Comment 6

[James Socol [:jsocol, :james]]

https://github.com/mozilla/kitsune/blob/master/settings.py#L588

This is fixed in the current version of Django. Confirmed that session cookies don't appear in document.cookie.

Comment 7

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.