819704 - SSL cookie without secure flag set on developer.mozilla.org

Status: RESOLVED FIXED

(developer.mozilla.org :: Security, defect, P2)

Description

[Artur]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20100101 Firefox/17.0
Build ID: 20121128204232

Steps to reproduce:

Good morning,

I found a vulnerability.


Actual results:

Description of vulnerability:
Issue: SSL cookie without secure flag set
 
Host: https://developer.mozilla.org


Expected results:

Secure flag must be set in SSL cookie.

Thank you very much for your reply.

Best Regards,
Artur Czyż

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

assigning for verification and rating

Comment 2

[Simon Bennetts [:psiinon]]

Confirmed on the csrftoken cookie.
Should probably also have the httponly flag set.

Comment 3

[David Chan [:dchan]]

The bounty committee has decided not to pay out on this bug due to the minimal impact of the missing SECURE flag.

Luke: Can we get the SECURE flag set on MDN cookies?

Comment 4

[James Socol [:jsocol, :james]]

(In reply to David Chan [:dchan] from comment #3)
> Luke: Can we get the SECURE flag set on MDN cookies?

The only cookie that can be changed in one project-wide swoop is the session cookie (which is now secure). Otherwise it has to be set per-cookie, when the cookie is set.

Switching to use django-session-csrf[1] (not sure why we aren't already) will remove the csrftoken cookie and stick the data in the session, which will address this particular issue (and another bug).

[1] https://github.com/mozilla/django-session-csrf

Comment 5

[Les Orchard [:lorchard]]

(In reply to James Socol [:jsocol, :james] from comment #4)

> Switching to use django-session-csrf[1] (not sure why we aren't already)
> will remove the csrftoken cookie and stick the data in the session, which
> will address this particular issue (and another bug).
> 
> [1] https://github.com/mozilla/django-session-csrf

That's bug 698427. Until very recently, the version of Django we were on was incompatible with django-session-csrf

Comment 6

[John Karahalis [:openjck]]

https://github.com/mozilla/kuma/pull/992

Comment 7

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.