<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10pt"><div><span>OK, so it sounds like even with HttpOnly, I am introducing a vulnerability. If I set HttpOnly on the cookie property, will that affect all users with existing cookies?</span></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> On Tuesday, April 1, 2014 2:10 PM, "Cantor, Scott" <cantor.2@osu.edu> wrote:<br> </font> </div> <div class="y_msg_container">On 4/1/14, 4:49 PM, "Mike Flynn" <<a shape="rect" ymailto="mailto:shibbolethlynda@yahoo.com"
href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> wrote:<br clear="none"><br clear="none">>I have a client whose IP address changes between requests. I have been<br clear="none">>using my test system to let them work out their details. I added<br clear="none">>consistentAddress="false" to my session stanza to allow them to test like<br clear="none">>this. My question is, what is the security risk by allowing this?<br clear="none"><br clear="none">An HTTP session cookie has no protection other than secrecy and address<br clear="none">binding, so you're removing the second and anybody with the right cookie<br clear="none">value is able to impersonate the session. Since browsers are riddled with<br clear="none">security holes around same-origin policies, that basically means if<br clear="none">somebody wants to steal the session, they probably can if they control a<br clear="none">site the user
visits.<br clear="none"><br clear="none">You can mitigate this slightly by making sure you use HttpOnly as a cookie<br clear="none">property, which is automatic in newer SP versions, but not in yours.<div class="yqt7673507482" id="yqtfd41135"><br clear="none"><br clear="none">>Does it facilitate man in the middle attacks?</div><br clear="none"><br clear="none">Among other kinds, yes.<br clear="none"><br clear="none">-- Scott<br clear="none"><br clear="none"><br clear="none">--<br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><div class="yqt7673507482" id="yqtfd58098"><br clear="none"></div><br><br></div> </div> </div> </div> </div></body></html>