Re: [WebDNA] Setting secure cookie

This WebDNA talk-list message is from

2009

It keeps the original formatting. numero = 102493
interpreted = N
texte = DonovanThis cookie thing is becoming one of the standard security scans from people such as McAfee Secure from https://www.mcafeesecure.comDescriptionThe application sets a cookie over a secure channel without using the "secure" attribute. RFC states that if the cookie does not have the secure attribute assigned to it, then the cookie can be passed to the server by the client over non-secure channels (http). Using this attack, an attacker may be able to intercept this cookie, over the non- secure channel, and use it for a session hijacking attack.General SolutionIt is best business practice that any cookies that are sent (set- cookie) over an SSL connection to explicitly state secure on them.Doing a redirect if not https - WebDNA does not detect https !You noted in an earlier post (8 April 09)"I don't know of many other WebDNA specific ways of finding this, so we *will* make one! :-)"I look forward to BOTH additions !!!Stuart Tremain wrote: > "It is best business practice that any cookies that are sent > (set-cookie) over an SSL connection to explicitly state secure on them." > > Can this be done in WebDNA [setcookie] ?No., but you could do it using [returnraw] I suppose.The 'secure' param is suggestion that user agents (browsers)only serve cookies with this param set if the connection is withSSL.You could easily force the issue anyway.. perhaps by doing aredirect if the connection is not https.There are a number of ways to secure sessions which don't requirethe 'secure' param to be set on a cookie.However, I will put that on the list of features to add, asI think it is a good one.Meanwhile, here is an RFC if you want to roll your own:http://www.ietf.org/rfc/rfc2965.txtDonovan-- Donovan BrookeWebDNA Software Corporationhttp://www.webdna.us**[Square Bracket Utopia]**RegardsStuart TremainIDFK Web DevelopmentsAUSTRALIAwebdna@idfk.com.au Associated Messages, from the most recent to the oldest:

Re: [WebDNA] Setting secure cookie (Donovan Brooke 2009)
Re: [WebDNA] Setting secure cookie (Stuart Tremain 2009)
Re: [WebDNA] Setting secure cookie (Donovan Brooke 2009)
[WebDNA] Setting secure cookie (Stuart Tremain 2009)

DonovanThis cookie thing is becoming one of the standard security scans from people such as McAfee Secure from https://www.mcafeesecure.comDescriptionThe application sets a cookie over a secure channel without using the "secure" attribute. RFC states that if the cookie does not have the secure attribute assigned to it, then the cookie can be passed to the server by the client over non-secure channels (http). Using this attack, an attacker may be able to intercept this cookie, over the non- secure channel, and use it for a session hijacking attack.General SolutionIt is best business practice that any cookies that are sent (set- cookie) over an SSL connection to explicitly state secure on them.Doing a redirect if not https - WebDNA does not detect https !You noted in an earlier post (8 April 09)"I don't know of many other WebDNA specific ways of finding this, so we *will* make one! :-)"I look forward to BOTH additions !!!Stuart Tremain wrote: > "It is best business practice that any cookies that are sent > (set-cookie) over an SSL connection to explicitly state secure on them." > > Can this be done in WebDNA [setcookie] ?No., but you could do it using [returnraw] I suppose.The 'secure' param is suggestion that user agents (browsers)only serve cookies with this param set if the connection is withSSL.You could easily force the issue anyway.. perhaps by doing aredirect if the connection is not https.There are a number of ways to secure sessions which don't requirethe 'secure' param to be set on a cookie.However, I will put that on the list of features to add, asI think it is a good one.Meanwhile, here is an RFC if you want to roll your own:http://www.ietf.org/rfc/rfc2965.txtDonovan-- Donovan BrookeWebDNA Software Corporationhttp://www.webdna.us**[Square Bracket Utopia]**RegardsStuart TremainIDFK Web DevelopmentsAUSTRALIAwebdna@idfk.com.au Stuart Tremain

DOWNLOAD WEBDNA NOW!

Re: [WebDNA] Setting secure cookie

2009

Top Articles:

Related Readings: