Re: [http-state] Welcome to http-state

On Tue, 13 Jan 2009 00:43:55 +0100, Blake Frantz <bfrantz@cisecurity.org>  
wrote:

>> Please note that RFC2965 already have such integrity checking through
> the
>> $Domain, $Path and $Port attributes.
>
> It's my understanding that these attributes are used to determine where
> the user agent should send the cookie to,

Not just that.

Clients are also required by RFC 2965 to send $Domain, $Path and $Port to  
the server for each cookie whenever the associated Domain, Path and Port  
parameters were used in the Set-Cookie2 header so that the server can pick  
the right one when multiple cookies have the same name.

My point about $Port is that if the server used either 'Port=' or  
'Port="443"' and checks for the $Port whenever the cookie is received, it  
will be able to detect if an unsecure server clobbered it, because that  
server would either have to use 'Port="80,443"', or not use Port at all,  
to be able to set the cookie and to get the cookie sent to the secure  
server. The receiving server will not be able to detect if a compromised  
secure server clobbered the cookie, but the $Origin field I am suggesting  
should handle that as long as the receiving server itself hasn't been  
compromised.

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: yngve@opera.com
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************
_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state