Uploaded image for project: 'mod_python'
  1. mod_python
  2. MODPYTHON-108

Let Cookie support new HttpOnly property to prevent cross-site cookie stealing

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 3.1.4, 3.3.x, 3.2.7
    • Fix Version/s: 3.3.1
    • Component/s: core
    • Labels:
      None

      Description

      The Cookie.Cookie class does not allow the new "httponly" cookie property to be set. It needs to be added to the valid slots on the cookie metaclass. Also note that like the "secure" cookie attribute, it is simple a boolean flag without any value.

      The HttpOnly flag was invented by Microsoft but seeing widespread support as a way to prevent cross-site scripting from stealing cookies using client-side Javascript. This is especially important for security-sensitive cookies, such as session keys.

      The mod_python session object should also explicitly set the HttpOnly property on the cookies it creates.

      See also these related references:
      1. http://msdn.microsoft.com/workshop/author/dhtml/httponly_cookies.asp
      2. http://search.cpan.org/~mschout/Apache-AuthCookie-3.08/lib/Apache2/AuthCookie.pm
      3. https://bugzilla.mozilla.org/show_bug.cgi?id=178993
      4. http://www.linux.com/howtos/Secure-Programs-HOWTO/cross-site-malicious-content.shtml

        Activity

        Hide
        grahamd Graham Dumpleton added a comment -

        Attached patch which should add the support for this. Someone else want to check for me as I am not an expert on cookies and don't have a browser which I know understands the option, nor do I know how one would conceivably test that it works as expected with that browser. Visually it seems to do the correct thing in terms of what is placed in the cookie in the headers.

        Show
        grahamd Graham Dumpleton added a comment - Attached patch which should add the support for this. Someone else want to check for me as I am not an expert on cookies and don't have a browser which I know understands the option, nor do I know how one would conceivably test that it works as expected with that browser. Visually it seems to do the correct thing in terms of what is placed in the cookie in the headers.
        Hide
        grahamd Graham Dumpleton added a comment -

        At the technical level, it appears to mark up cookie as it is meant to. Thus change has been committed and marked resolved. It really needs someone who understands how this thing is used to actually put it into practice and come back and say that it does as advertised in preventing cross site scripting attacks.

        Show
        grahamd Graham Dumpleton added a comment - At the technical level, it appears to mark up cookie as it is meant to. Thus change has been committed and marked resolved. It really needs someone who understands how this thing is used to actually put it into practice and come back and say that it does as advertised in preventing cross site scripting attacks.

          People

          • Assignee:
            grahamd Graham Dumpleton
            Reporter:
            dmeranda Deron Meranda
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development