Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Security Best Current Practice?
Giuseppe De Marco <demarcog83@gmail.com> Mon, 06 November 2023 14:21 UTC
Return-Path: <demarcog83@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 747BEC15C299 for <oauth@ietfa.amsl.com>; Mon, 6 Nov 2023 06:21:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.854
X-Spam-Level:
X-Spam-Status: No, score=-1.854 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dhEIRsE4Al0j for <oauth@ietfa.amsl.com>; Mon, 6 Nov 2023 06:21:19 -0800 (PST)
Received: from mail-ed1-x52f.google.com (mail-ed1-x52f.google.com [IPv6:2a00:1450:4864:20::52f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66E3CC17C8BD for <oauth@ietf.org>; Mon, 6 Nov 2023 06:21:19 -0800 (PST)
Received: by mail-ed1-x52f.google.com with SMTP id 4fb4d7f45d1cf-54366784377so7437622a12.3 for <oauth@ietf.org>; Mon, 06 Nov 2023 06:21:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1699280478; x=1699885278; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=AJiBWcJDXDVOg1ADS/3WIzomsoA15kI3uinm/4YotbA=; b=aC2amGffLFl6z2a8afJoZR7YclzVM47yP5Pky9Bh264WD4THs4TbZEdLd0eCA2Y/a8 y8h9HdBrZRR3YrOtjNzVIgzidVH1GTdy05Pin1gC1W2BMRhD8fHzQRne8d7GSFDYNskT ujl1Z82ruTn0oz4bnM560V/ALhc3/149y5xWCcarMOD8txD+ZV5cE85AuGFTGKQcjmF4 JM/ebTmLfI4MM3L/n1d7vmdXjEfj2rWOZkU++GqbIPpzFxgaLxk9aVY99rgSxmqo1y+K v3oU1zpXKTHBMziv5YY7wXBvOVvwlHtCSZNebQfN51b9qVjuxguEvhmA8I7EQTYN7mhl zazQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1699280478; x=1699885278; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=AJiBWcJDXDVOg1ADS/3WIzomsoA15kI3uinm/4YotbA=; b=syo383wZWpElXYJUxoUKK4UmNqXg/29HQ1C9AGUp2cV3IDb2UzaCfnQD132sCPlcAq XnFreuAb3I0oNtM18KcjGBQrz3rIQqdaek8YpPLB7P6MqExkfauAxFLBorwcP551VjgN PWhjIuZ80izo86t/O2WxQFuASVZI07W7QMyEZ0pVbHRPq9+GulFoq4YnkfFz6TYPzS6c qXsEKEh8dN9r7uIy8PlorukgNI0ixLR6ryMTrAp9r5SVMcXXDiuecEctZONmbAQV3oAu qKyFs3Jd/LX9hrYK8iZPKGG9qTjfengEGT5cw1TCAsXn0BEMQPV9/i/D1CBl86Y5Iayn iaXg==
X-Gm-Message-State: AOJu0Yx+j7JOsukeFsvgbs83JwBAT64Wkleb5hnKvJ084yvdkafOHk6V j6ff316t+lkX/zmqqifL5h7prgb85qCKbf00Zkw=
X-Google-Smtp-Source: AGHT+IFRPDaK9sQhs8AuJyGGcS0yEtBeXG8C72t9DtLqMJTeN5lu2fpix9+hGDmDL2oHIDwpw6p4atnG8UJ4zArJGno=
X-Received: by 2002:aa7:d60e:0:b0:53f:ded4:15b9 with SMTP id c14-20020aa7d60e000000b0053fded415b9mr25442733edr.10.1699280477333; Mon, 06 Nov 2023 06:21:17 -0800 (PST)
MIME-Version: 1.0
References: <CAD9ie-sh0qnGzg5VwU_enq2Br9hH5zgm86z9i7vdMj_uQs=4yA@mail.gmail.com> <CAGBSGjrMDrXMd2ApKmLn_LVgMSLME-wvHqPCTpzgDxk5_+kRSA@mail.gmail.com> <f6383d62-9586-49c9-a824-9d92288ee4bd@danielfett.de> <CAGBSGjqe2HjJuh6OgJy5VU+w8HRyu159uJtMnmXS+LPWg_LphA@mail.gmail.com> <CAD9ie-sfrzEMvS8yk49XSNfvwRbcj1tPKfmNxC97VAF4pRqcfg@mail.gmail.com> <C3E1A2E4-AFE0-4C85-8F53-0C1C0154107A@gmail.com>
In-Reply-To: <C3E1A2E4-AFE0-4C85-8F53-0C1C0154107A@gmail.com>
From: Giuseppe De Marco <demarcog83@gmail.com>
Date: Mon, 06 Nov 2023 15:21:06 +0100
Message-ID: <CAP_qYyktwsB_d0pqhMacM3Ma+wMUdDdKT56EMv6LY2xKndRVQA@mail.gmail.com>
To: Neil Madden <neil.e.madden@gmail.com>
Cc: "dick.hardt" <Dick.Hardt@gmail.com>, Aaron Parecki <aaron=40parecki.com@dmarc.ietf.org>, Daniel Fett <fett=40danielfett.de@dmarc.ietf.org>, oauth@ietf.org
Content-Type: multipart/alternative; boundary="00000000000039ae5c06097c91f5"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/WeOG1pYGdc8flL3arxmmE4iUKZE>
Subject: Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Security Best Current Practice?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Nov 2023 14:21:23 -0000
Hi, everytime I have implemented SAML2, OAuth 2.0, OpenID Connect, for different projects and orgs, I have included secured web cookie in the recipe. For the implementation profile of OpenID4VP I did the same, where the secured and httponly cookie is used an in particular as a basic security requirement for the cross device flow [1]. Even if I got perfectly Daniel's and Aaron's editorial strategy and I agree, I think that Dick's proposal and your confirmation on that, Neil, is something to take into account to bring developers awareness during the implementation phases. A ref to living OWASP specs surrounded by a generic refs to the user agent security, even if out of scope, I think that should be in the specs. [1] https://italia.github.io/eudi-wallet-it-docs/versione-corrente/en/relying-party-solution.html#remote-protocol-flow Il giorno lun 6 nov 2023 alle ore 15:11 Neil Madden <neil.e.madden@gmail.com> ha scritto: > Although I think we could add some basic advice, the list of security > headers to use is still evolving. For example, there were several headers > added after Spectre to limit cross-site interactions. And then there’s > things like the “X-XSS-Protection” header, which was best practice to add > to responses not too long ago but has now been universally removed from > browsers as it enabled certain content disclosure attacks. > > Cookie security attributes are perhaps a bit more stable, but in general > we probably just want to point people at “living” guidance like OWASP. > > — Neil > > On 5 Nov 2023, at 19:28, Dick Hardt <dick.hardt@gmail.com> wrote: > > The cookie and header recommendations I am thinking of would be for the AS > as well as the client. > > A number of XSS attacks can be thwarted by a modern browser and the right > HTTP headers. > > My question is: Did the authors consider adding cookie and header > recommendations, and decided it was too general? > > Cookie and header best security practices have been around for years -- > I'm not suggesting we make anything up -- I'm suggesting we raise > awareness. > > I consider myself to be fairly security aware, and I was not aware of some > of the HTTP headers that are best security practice. > > /Dick > > > On Sun, Nov 5, 2023 at 11:19 AM Aaron Parecki <aaron= > 40parecki.com@dmarc.ietf.org> wrote: > >> I don't think it's necessary to say "do the right things with cookies" in >> the Security BCP. The Browser Apps BCP has a much deeper discussion of how >> different browser-based architectures work with cookies so that seems like >> a better place to actually have a real discussion about it. >> >> Also +1 to what Daniel said about not continuing to add little things. >> Plus I think it's too late anyway, publication has already been requested >> for the Security BCP. >> >> Aaron >> >> On Sun, Nov 5, 2023 at 11:14 AM Daniel Fett <fett= >> 40danielfett.de@dmarc.ietf.org> wrote: >> >>> I agree with Aaron! >>> >>> Also we should be very careful about any additions to the Security BCP >>> at this point. It is very easy to re-start the "one more thing" loop we've >>> been stuck in for the last years. There may be more useful things to say, >>> but we should put them on the list for a future second version of the BCP. >>> >>> -Daniel >>> Am 05.11.23 um 20:03 schrieb Aaron Parecki: >>> >>> I don't think the Security BCP should incorporate cookie best practices >>> directly in the document. If anything, it sounds like possibly a candidate >>> for inclusion in the Browser Apps BCP. >>> >>> There are already some mentions of these cookie properties mentioned in >>> the Browser Apps BCP, though only in reference to specific architectures, >>> not as a general best practice. For example: >>> >>> >>> https://www.ietf.org/archive/id/draft-ietf-oauth-browser-based-apps-15.html#pattern-bff-cookie-security >>> >>> Aaron >>> >>> On Sun, Nov 5, 2023 at 10:48 AM Dick Hardt <dick.hardt@gmail.com> wrote: >>> >>>> Hey >>>> >>>> I was reviewing security on some sites I managed and checked to see if >>>> the recommendations were in the BCP. >>>> >>>> I don't see anything around cookies such as httpOnly, sameSite, secure. >>>> >>>> I saw some HTTP security header suggestions buried in 4.16 >>>> (X-Frame-Options, CSP), but not for Strict-Transport-Security, >>>> Permissions-Policy, or X-Content-Type-Options, and the CSP guidance is >>>> rather vague. >>>> >>>> I understand these are general web security best practices, and perhaps >>>> I missed it, but I think it would be useful to call out that best security >>>> practices around cookies and headers should also be followed in Section 2, >>>> and either have the best practices included, or direct the reader where to >>>> find them. >>>> >>>> /Dick >>>> >>>> _______________________________________________ >>>> OAuth mailing list >>>> OAuth@ietf.org >>>> https://www.ietf.org/mailman/listinfo/oauth >>>> >>> >>> _______________________________________________ >>> OAuth mailing listOAuth@ietf.orghttps://www.ietf.org/mailman/listinfo/oauth >>> >>> _______________________________________________ >>> OAuth mailing list >>> OAuth@ietf.org >>> https://www.ietf.org/mailman/listinfo/oauth >>> >> _______________________________________________ >> OAuth mailing list >> OAuth@ietf.org >> https://www.ietf.org/mailman/listinfo/oauth >> > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth > > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth >
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Dick Hardt
- [OAUTH-WG] Cookies & headers in OAuth 2.0 Securit… Dick Hardt
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Aaron Parecki
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Daniel Fett
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Aaron Parecki
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Dick Hardt
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Dick Hardt
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Dick Hardt
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Neil Madden
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Neil Madden
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Giuseppe De Marco
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Dick Hardt
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Philippe De Ryck
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Dick Hardt
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Philippe De Ryck
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Dick Hardt
- Re: [OAUTH-WG] Cookies & headers in OAuth 2.0 Sec… Philippe De Ryck