Skip to main content

Insecurely generated cookies - SameSite

Need​

Secure generation of cookies with properly set SameSite attribute

Context​

  • Usage of C# 7.0 for modern language features and enhancements
  • Usage of Microsoft.AspNetCore.App for building web applications with ASP.NET Core

Description​

Non compliant code​

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseCookiePolicy(new CookiePolicyOptions
    {
        MinimumSameSitePolicy = SameSiteMode.None,
    });

    app.UseAuthentication();

    // Other configurations...
}

In the code snippet above, an ASP.NET Core application is configuring its cookie policy. The MinimumSameSitePolicy is set to SameSiteMode.None. This means that the application's cookies are not restricted to first-party usage only, they can be sent with both first-party and cross-origin requests. This is a potential security vulnerability as it opens the application up to Cross-Site Request Forgery (CSRF) attacks. CSRF attacks trick the victim into submitting a malicious request. It uses the identity and privileges of the victim to perform an undesired function on their behalf.

In the context of cookies, if a SameSite attribute is not properly set, attackers can exploit this vulnerability by tricking a user's browser into making a request to a target site where the user is authenticated, causing unwanted actions to be performed on behalf of the user without their consent. This is especially dangerous if the user has administrative privileges, as it could lead to a full account takeover.

To protect against CSRF attacks, it is recommended to properly set the SameSite attribute for cookies. The SameSite attribute can prevent the browser from sending cookies along with cross-site requests. There are three possible values for the SameSite attribute: Strict, Lax, and None. The Strict value will prevent the cookie from being sent in all cross-site browsing contexts. The Lax value provides a balance between security and usability by allowing cookies to be sent with top-level navigations. The None value, on the other hand, does not restrict the sending of cookies in any way, which is the case in the provided code snippet.

Therefore, this code is vulnerable to CSRF attacks due to the insecure generation of cookies without properly setting the SameSite attribute.

Steps​

  • Update the ASP.NET Core version to a version that supports SameSite attribute for cookies.
  • Set the SameSite attribute for cookies to 'Strict' or 'Lax' depending on your application's requirements.
  • Ensure that the 'Secure' attribute is set for cookies that should only be sent over secure connections (HTTPS).
  • Consider implementing additional security measures such as CSRF protection to further enhance the security of your application.

Compliant code​

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseCookiePolicy(new CookiePolicyOptions
    {
        MinimumSameSitePolicy = SameSiteMode.Strict,
        HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.Always,
        Secure = CookieSecurePolicy.Always
    });

    app.UseAuthentication();

    // Other configurations...
}

The updated code now sets the MinimumSameSitePolicy to SameSiteMode.Strict. This means that the browser will only send the cookie if the request originated from the same site. This is a good default setting as it provides a good level of protection against cross-site request forgery (CSRF) attacks, but still allows the user to navigate through the site without any issues.

The HttpOnly attribute is set to Always, which means that the cookie cannot be accessed through client-side scripts. This provides protection against cross-site scripting (XSS) attacks.

The Secure attribute is set to Always, which means that the cookie will only be sent over secure (HTTPS) connections. This provides protection against man-in-the-middle (MITM) attacks.

These changes will significantly enhance the security of your application by ensuring that cookies are generated and handled in a secure manner.

References​

Last updated on