Re: [http-state] Welcome to http-state

On Mon, Jan 12, 2009 at 2:58 PM, Blake Frantz <bfrantz@cisecurity.org> wrote:

(out of order)

> For the purpose of this
> group, I think we may have identified another bullet item in the list of
> things to accomplish - figure out the best way to protect the integrity
> of Secure cookies.

I'm not an expert on what is or is not in scope for this working
group, but I think its important to protect the integrity of Secure
cookies.  Most people fall out of their chair when they realize Secure
cookies lack integrity.

(Further comments for those interested in the details of this discussion.)

> If the user agent treated two otherwise equal cookies from disparate
> schemes distinctly then the attacker must control content in the HTTPS
> scheme to impact the integrity of the Secure cookie.

While technically true, this doesn't actually help in practice because
Secure and non-Secure cookies are serialized identically in the Cookie
header, make it impossible for the server to tell whether the cookie
was set over HTTP or HTTPS.

> Nice work. In support of this, it *may* be beneficial to modify existing
> XHR mechanisms such that they prevent the programmatic creation of a
> Cookie-Integrity header (http://www.w3.org/TR/XMLHttpRequest/#security).
> I haven't thought through this entirely, though.

XHR has a generic generic namespace of headers that can't be set by
script: those that begin with "Sec-".  We could simple name the header
"Sec-Cookie-Integrity" if we want this behavior.

>> 1) It is backwards compatible with existing servers who might
>> legitimately overwrite Secure cookies over HTTPS (for example, during
>> "logout").
>
> The cross scheme clobber prevention I'm attempting to get feedback on
> does not break this use case.

Oops.  Typo.  I meant "overwrite Secure cookies over HTTP (for
example, during logout)."  We could gather data how often this occurs,
but I suspect many sites that use both HTTP and HTTPS store auth
credentials in a Secure cookie, which they delete with an HTTP request
upon logout.

Adam
_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state