[http-state] Security considerations overview

Adam Barth <ietf@adambarth.com> Tue, 02 March 2010 19:03 UTC

Return-Path: <ietf@adambarth.com>
X-Original-To: http-state@core3.amsl.com
Delivered-To: http-state@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3BA323A8C58 for <http-state@core3.amsl.com>; Tue, 2 Mar 2010 11:03:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p826mZwXi5sY for <http-state@core3.amsl.com>; Tue, 2 Mar 2010 11:03:57 -0800 (PST)
Received: from mail-qy0-f195.google.com (mail-qy0-f195.google.com [209.85.221.195]) by core3.amsl.com (Postfix) with ESMTP id 656CA3A82F0 for <http-state@ietf.org>; Tue, 2 Mar 2010 11:03:57 -0800 (PST)
Received: by qyk33 with SMTP id 33so326810qyk.17 for <http-state@ietf.org>; Tue, 02 Mar 2010 11:03:55 -0800 (PST)
Received: by 10.224.52.88 with SMTP id h24mr3635196qag.315.1267556631786; Tue, 02 Mar 2010 11:03:51 -0800 (PST)
Received: from mail-iw0-f179.google.com (mail-iw0-f179.google.com [209.85.223.179]) by mx.google.com with ESMTPS id 22sm4325518iwn.4.2010.03.02.11.03.50 (version=SSLv3 cipher=RC4-MD5); Tue, 02 Mar 2010 11:03:50 -0800 (PST)
Received: by iwn9 with SMTP id 9so575883iwn.17 for <http-state@ietf.org>; Tue, 02 Mar 2010 11:03:49 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.170.136 with SMTP id d8mr73470ibz.17.1267556629113; Tue, 02 Mar 2010 11:03:49 -0800 (PST)
From: Adam Barth <ietf@adambarth.com>
Date: Tue, 2 Mar 2010 11:03:29 -0800
Message-ID: <5c4444771003021103s422a65c3me96af57dfee58105@mail.gmail.com>
To: http-state <http-state@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1
Subject: [http-state] Security considerations overview
X-BeenThere: http-state@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discuss HTTP State Management Mechanism <http-state.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/http-state>
List-Post: <mailto:http-state@ietf.org>
List-Help: <mailto:http-state-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Mar 2010 19:03:58 -0000

Rather than have a blanked "cookies are bad" statement at the
beginning of the security considerations section, Tyler suggested that
we overview the main security issues with cookie (of course, providing
details later in the section).  Here's a first draft of an overview
section.

      <section anchor="section-overview" title="Overview">
        <t>The cookie protocol has a number of security and privacy
        pitfalls.</t>

        <t>In particular, cookies encourage developers to rely on ambient
        authority for authentication, often creating vulnerabilities such as
        cross-site request forgery.  When storing session identifiers in
        cookies, developers often create session fixation
        vulnerabilities.</t>

        <t>Transport-layer encryption, such as HTTPS, is insufficient to
        prevent a network attacker from altering a victim's cookies because
        the cookie protocol does not provide integrity.  By default, cookies
        are transmitted in the clear, where their confidentiality can be
        compromised by a network attacker.</t>
      </section>

Adam