Re: [http-state] Welcome to http-state

> The attacker can still disrupt the integrity of the Secure cookie by
> first causing the cookie to be evicted and then creating a new,
> non-Secure cookie with the same name.  This has the same effect as
> overwriting the Secure cookie.

If the user agent treated two otherwise equal cookies from disparate
schemes distinctly then the attacker must control content in the HTTPS
scheme to impact the integrity of the Secure cookie. This assumes that
the Secure cookie was set over HTTPS - which I think is safe. From what
I've read in section 6.2 of the paper you've referenced, the attacker
requirements to compromise the integrity of the Secure cookie are
equivalent with the approach I'm seeking feedback on. Those requirements
being control of content rendered in the HTTPS scheme.

> An alternate way to protect the integrity of Secure cookies is to add
> a "Cookie-Integrity" header that lists the cookies set over HTTPS, as
> described in 6.2 of
> http://www.adambarth.com/papers/2008/barth-jackson-mitchell-b.pdf

Nice work. In support of this, it *may* be beneficial to modify existing
XHR mechanisms such that they prevent the programmatic creation of a
Cookie-Integrity header (http://www.w3.org/TR/XMLHttpRequest/#security).
I haven't thought through this entirely, though. 

> The Cookie-Integrity header has two advantages over altering the
> semantics of Set-Cookie:
>
> 1) It is backwards compatible with existing servers who might
> legitimately overwrite Secure cookies over HTTPS (for example, during
> "logout").

The cross scheme clobber prevention I'm attempting to get feedback on
does not break this use case.

My take away from this is that you see a need to protect the integrity
of Secure cookies, where possible. I agree with this. I'm not convinced
that treating cross-scheme cookies distinctly or adding Cookie-Integrity
header is or is not the solution to the problem. For the purpose of this
group, I think we may have identified another bullet item in the list of
things to accomplish - figure out the best way to protect the integrity
of Secure cookies.

Blake

_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state