Re: [http-state] Welcome to http-state

On Mon, Jan 12, 2009 at 1:47 PM, Blake Frantz <bfrantz@cisecurity.org> wrote:
> Agreed that cross-scheme clobbering is historically allowed by user
> agents. However, clobbering a cookie is different than causing a cookie
> to be evicted. The former impacts the integrity of the cookie while the
> latter impacts cookie availability. The purpose of an anti-clobber
> mechanism is to protect the integrity of the Secure cookie.

The attacker can still disrupt the integrity of the Secure cookie by
first causing the cookie to be evicted and then creating a new,
non-Secure cookie with the same name.  This has the same effect as
overwriting the Secure cookie.

An alternate way to protect the integrity of Secure cookies is to add
a "Cookie-Integrity" header that lists the cookies set over HTTPS, as
described in 6.2 of
http://www.adambarth.com/papers/2008/barth-jackson-mitchell-b.pdf

> I see such a mechanism as a defense in depth measure - akin to HttpOnly.

The Cookie-Integrity header has two advantages over altering the
semantics of Set-Cookie:

1) It is backwards compatible with existing servers who might
legitimately overwrite Secure cookies over HTTPS (for example, during
"logout").

2) It protects the integrity of the cookies in a clearly defined threat model.

Adam
_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state