IdP cookie protection

[Chad La Joie]

Actually, I should say "given the way browser AND CONTAINERS currently
break when they encounter unexpected things in cookies".  It's not
just the browsers that have bitten us in the past.

On Thu, Feb 23, 2012 at 10:18, Chad La Joie <lajoie at itumi.biz> wrote:
> Well, the cookie you're showing there isn't the session cookie and
> stealing it won't get you anything.
>
> That said, the session cookie doesn't currently use HttpOnly because
> the APIs don't expose a way to set that.  Also, given the way browser
> currently break when they encounter unexpected things in cookies, I've
> always been very uncomfortable using these non-standard extensions.
>
> On Thu, Feb 23, 2012 at 10:03, Lukas Hämmerle <lukas.haemmerle at switch.ch> wrote:
>> On 23.02.12 15:26, Peter Schober wrote:
>>> * Chad La Joie <lajoie at itumi.biz> [2012-02-23 15:22]:
>>>> The cookie isn't considered part of the public API so there isn't any
>>>> documentation of it outside the code itself.  That said, the
>>>> protections in place are:
>>>> - normal cookie domain/path settings
>>>> - user-agent address checking
>>>> - cookie content signatures using a server-side, per-session secret key
>>>> - randomly generated sessions IDs
>>>
>>> - flagging them "secure" (might go under "normal cookies settings",
>>>   though not domain/path related)
>>
>> What about the HttpOnly flag?
>> http://en.wikipedia.org/wiki/HTTP_cookie#HttpOnly_cookie
>>
>> Checking the latest version of the IdP, the cookie looks like:
>>
>> Set-Cookie: _idp_authn_lc_key=9ec251e3-f87d-455f-ac0f-1234567890ab;
>> Version=1; Path=/idp; Secure
>>
>> This might also increase the protection against cookie theft from XSS
>> attacks.
>>
>> Kind Regards
>> Lukas
>>
>> --
>> SWITCH
>> Serving Swiss Universities
>> --------------------------
>> Lukas Hämmerle, Software Engineer, Central Solutions
>> Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
>> phone +41 44 268 15 05, direct +41 44 268 15 64
>> lukas.haemmerle at switch.ch, http://www.switch.ch
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered