828221 - HttpOnly cookies must never be sent to, or set from, child processes

Status: RESOLVED DUPLICATE of bug 1339129

(Core :: Networking, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #827853 +++
+++ This bug was initially created as a clone of Bug #827847 +++

If a cookie is marked HttpOnly, then we should not allow child processes any access to it, and we should only allow the child processes access to the cookie through document.cookie. This will provide defense in depth for sites that use HttpOnly cookies (often auth cookies) against compromised content processes.

Comment 1

[Jason Duell]

Not clear yet if we can block httpOnly from being set in child.

Jonas also seems to think we could get away with preventing *any* cookie headers from being seen in child unless app has system XHR privileges.

Much will depend on bug 805616--we can only do 3rd party checks correctly in child (? maybe we could do work to not make that true), so we might need to set cookies on child, in which case we have to let them see them.