Re: Linking a cookie to an IP address is a very bad in 2015...

[Jim Manico <[e-mail]>]

It effectively stops JS from reading a cookie. All browsers support it well today. Use is, it does no harm.

--
Jim Manico
@Manicode
[phone]

> On Apr 2, 2015, at 9:18 AM, Zhong Yu <[e-mail]> wrote:
> 
> The HttpOnly flag is ... interesting. If a page contains injected
> scripts, game over, the attacker can do anything as the authorized
> user. The HttpOnly flag is like, you are walking in a thunderstorm?
> here, wear this tinfoil hat.
> 
> Zhong Yu
> bayou.io
> 
> 
>> On Thu, Apr 2, 2015 at 5:46 AM, Michael Sweet <[e-mail]> wrote:
>> The cookie info should not be accessible to JavaScript if the HttpOnly flag
>> is specified when the cookie is set... (Unless the browser is seriously
>> broken...)
>> 
>> Sent from my iPad
>> 
>> On Apr 2, 2015, at 2:18 AM, Eric Vyncke (evyncke) <[e-mail]> wrote:
>> 
>> Using User-Agent appears to me as more stable than the IP address for sure
>> :-)
>> 
>> And to reply to the suggestion of always using SSL (which is probably good
>> anyway): it is not enough as cookies can be stolen from the browser itself
>> if an attacker can inject some javascript into the browser (using the good
>> old cross site scripting for example)
>> 
>> -éric
>> 
>> From: Max Bruce <[e-mail]>
>> Date: mercredi 1 avril 2015 15:57
>> To: Willy Tarreau <[e-mail]>
>> Cc: Jim Manico <[e-mail]>, Michael Sweet <[e-mail]>, Eric
>> Vyncke <[e-mail]>, "[e-mail]" <[e-mail]>
>> Subject: Re: Linking a cookie to an IP address is a very bad in 2015...
>> 
>> That's a great point. What about User-Agent checking?
>> 
>>> On Wed, Apr 1, 2015 at 12:54 PM, Willy Tarreau <[e-mail]> wrote:
>>> 
>>>> On Wed, Apr 01, 2015 at 12:48:36PM -0700, Max Bruce wrote:
>>>> What about linking to several? I wrote a session system for my Web
>>>> Server
>>>> that will only allow access to the original Session ID if the IP &
>>>> User-Agent has remained unchanged, in order to protect against session
>>>> hijacking. I've found it's highly effective, unless you IP Spoof.
>>> 
>>> Sure it's highly effective. Just like it's highly effective in randomly
>>> denying access to people who browse using multiple WiFi access point or
>>> who switch between 3G and WiFi.
>>> 
>>> Willy
>>