Skip to main content

Insecurely generated cookies - HttpOnly

Need​

Secure generation of cookies with the HttpOnly attribute

Context​

  • Usage of C# for building robust and scalable applications
  • Usage of Microsoft.AspNetCore.CookiePolicy for managing cookie policies in ASP.NET Core applications

Description​

Non compliant code​

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseCookiePolicy(new CookiePolicyOptions
    {
        MinimumSameSitePolicy = SameSiteMode.None,
    });

    //...
}

This C# code snippet is part of an ASP.NET Core backend application. It is configuring the cookie policy for the application. The MinimumSameSitePolicy is set to SameSiteMode.None, which means the application's cookies can be sent with both same-site and cross-site requests.

However, the HttpOnly attribute is not set in the cookie policy. This attribute is crucial for security because it prevents client-side scripts from accessing the cookie. Without this attribute, if an attacker can inject script into the web application (through XSS, for example), they can read the cookie data and potentially hijack the user's session.

In this code, the absence of the HttpOnly attribute in the cookie policy means all cookies will be accessible via client-side script by default. This is a significant security vulnerability because it increases the risk of successful cross-site scripting (XSS) attacks.

To fix this vulnerability, the HttpOnly attribute should be set to true in the cookie policy. This will prevent client-side scripts from accessing the cookie, mitigating the risk of XSS attacks.

Steps​

  • Set the 'HttpOnly' attribute for all cookies generated by the application.
  • Ensure that the 'MinimumSameSitePolicy' is set to 'SameSiteMode.Strict' or 'SameSiteMode.Lax' to prevent cross-site request forgery (CSRF) attacks.
  • Verify that the application is using the latest version of ASP.NET Core to leverage any security enhancements and bug fixes.
  • Regularly review and update the application's dependencies, including the ASP.NET Core framework, to address any known security vulnerabilities.
  • Implement secure coding practices to minimize the risk of other security vulnerabilities in the application.

Compliant code​

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseCookiePolicy(new CookiePolicyOptions
    {
        MinimumSameSitePolicy = SameSiteMode.Strict,
        HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.Always
    });

    //...
}

The updated code now sets the HttpOnly attribute for all cookies generated by the application. This attribute is crucial as it helps to mitigate the risk of cross-site scripting (XSS) by preventing the cookie from being accessed via client-side scripts.

The MinimumSameSitePolicy is also set to SameSiteMode.Strict. This setting ensures that the browser only sends the cookie with "same-site" requests, i.e., requests originating from the same domain that set the cookie. This policy helps to mitigate the risk of cross-site request forgery (CSRF) attacks.

It's important to note that these changes alone may not fully secure your application. You should ensure that your application is using the latest version of ASP.NET Core to leverage any security enhancements and bug fixes. Regularly review and update the application's dependencies, including the ASP.NET Core framework, to address any known security vulnerabilities.

Finally, implementing secure coding practices is crucial to minimize the risk of other security vulnerabilities in the application. This includes practices such as input validation, output encoding, and proper error handling.

References​

Last updated on