854165 - Session cookies are not HTTPOnly

Status: VERIFIED FIXED

(developer.mozilla.org :: Security, defect)

Description

[Raymond Forbes[:rforbes]]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:22.0) Gecko/20130319 Firefox/22.0
Build ID: 20130319030939

Steps to reproduce:

The session cookie is not protected with the HTTPOnly or secure flag.

Comment 1

[Raymond Forbes[:rforbes]]

I was able to steal a users session by taking the session cookie and inserting it into a new browser session.

Comment 2

[James Socol [:jsocol, :james]]

We'll need to update Django to get the HTTPOnly setting, but we just need:

SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True

in settings. Given that all traffic is over SSL, I'm surprised the former wasn't set already.

Comment 3

[James Socol [:jsocol, :james]]

SESSION_COOKIE_SECURE is already set to True in Kuma's settings.

https://github.com/mozilla/kuma/blob/master/settings.py#L731

Added HTTPONLY in a pull req: https://github.com/mozilla/kuma/pull/955

Comment 4

[James Socol [:jsocol, :james]]

:rforbes - How did you steal the session cookie? I don't see it submitted over HTTP from my browser.

Comment 5

[Raymond Forbes[:rforbes]]

i stole it by hand just to test to see if it works.  We recently had a XSS vulnerability submitted for MDN which is a typical way of grabbing the session cookie.

Comment 6

[James Socol [:jsocol, :james]]

(In reply to Raymond Forbes[:rforbes] from comment #5)
> i stole it by hand just to test to see if it works.  We recently had a XSS
> vulnerability submitted for MDN which is a typical way of grabbing the
> session cookie.

"stole it by hand"? I'm not sure I follow. Were you able to get the browser to transmit it over HTTP?

XSS will be mitigated by HTTPOnly, which depends on bug 841772.

(In reply to Raymond Forbes[:rforbes] from comment #1)
> I was able to steal a users session by taking the session cookie and
> inserting it into a new browser session.

Does this mean you went into the browser settings, got the cookie value, went into a new browser, set the cookie value, and were logged in? That's pretty much expected behavior.

Comment 7

[Raymond Forbes[:rforbes]]

I stole it by hand by opening two browsers, grabbing the cookie value and inserting into the other browser.

i realize this is expected when you do only client side session validation but if we do that we have to be extra careful of things like XSS and making sure the cookie has httponly flag set.  as long as the flag isn't set and we validate based on the client the session will be vulnerable.

Comment 8

[James Socol [:jsocol, :james]]

I'm throwing out my other confusion and questions:

It sounds like the only issue is that we don't have the HTTPOnly flag, is that correct?

Assuming that's correct, this depends on bug 841772, and I've set it as a blocker.

Comment 9

[Raymond Forbes[:rforbes]]

yup, that's the one issue i was trying to bring up with this bug.

Comment 11

[James Socol [:jsocol, :james]]

I no longer see the sessionid in document.cookie.

Might need to sign out and back in or clear the cookie to get the new httponly version.

Comment 12

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.