IdP cookie protection

[Lukas Hämmerle]

On 23.02.12 15:26, Peter Schober wrote:
> * Chad La Joie <lajoie at itumi.biz> [2012-02-23 15:22]:
>> The cookie isn't considered part of the public API so there isn't any
>> documentation of it outside the code itself.  That said, the
>> protections in place are:
>> - normal cookie domain/path settings
>> - user-agent address checking
>> - cookie content signatures using a server-side, per-session secret key
>> - randomly generated sessions IDs
> 
> - flagging them "secure" (might go under "normal cookies settings",
>   though not domain/path related)

What about the HttpOnly flag?
http://en.wikipedia.org/wiki/HTTP_cookie#HttpOnly_cookie

Checking the latest version of the IdP, the cookie looks like:

Set-Cookie: _idp_authn_lc_key=9ec251e3-f87d-455f-ac0f-1234567890ab;
Version=1; Path=/idp; Secure

This might also increase the protection against cookie theft from XSS
attacks.

Kind Regards
Lukas

-- 
SWITCH
Serving Swiss Universities
--------------------------
Lukas Hämmerle, Software Engineer, Central Solutions
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch