IdP cookie protection

[Chad La Joie]

Well, the cookie you're showing there isn't the session cookie and
stealing it won't get you anything.

That said, the session cookie doesn't currently use HttpOnly because
the APIs don't expose a way to set that.  Also, given the way browser
currently break when they encounter unexpected things in cookies, I've
always been very uncomfortable using these non-standard extensions.

On Thu, Feb 23, 2012 at 10:03, Lukas Hämmerle <lukas.haemmerle at switch.ch> wrote:
> On 23.02.12 15:26, Peter Schober wrote:
>> * Chad La Joie <lajoie at itumi.biz> [2012-02-23 15:22]:
>>> The cookie isn't considered part of the public API so there isn't any
>>> documentation of it outside the code itself.  That said, the
>>> protections in place are:
>>> - normal cookie domain/path settings
>>> - user-agent address checking
>>> - cookie content signatures using a server-side, per-session secret key
>>> - randomly generated sessions IDs
>>
>> - flagging them "secure" (might go under "normal cookies settings",
>>   though not domain/path related)
>
> What about the HttpOnly flag?
> http://en.wikipedia.org/wiki/HTTP_cookie#HttpOnly_cookie
>
> Checking the latest version of the IdP, the cookie looks like:
>
> Set-Cookie: _idp_authn_lc_key=9ec251e3-f87d-455f-ac0f-1234567890ab;
> Version=1; Path=/idp; Secure
>
> This might also increase the protection against cookie theft from XSS
> attacks.
>
> Kind Regards
> Lukas
>
> --
> SWITCH
> Serving Swiss Universities
> --------------------------
> Lukas Hämmerle, Software Engineer, Central Solutions
> Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
> phone +41 44 268 15 05, direct +41 44 268 15 64
> lukas.haemmerle at switch.ch, http://www.switch.ch
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered