Skip to main content

Insecurely generated cookies - Secure

Need​

Secure generation and transmission of cookies

Context​

  • Usage of C# for developing robust and efficient applications
  • Usage of Microsoft.AspNetCore.CookiePolicy for managing and enforcing cookie policies in ASP.NET Core applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications using the MVC pattern

Description​

Non compliant code​

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseCookiePolicy(new CookiePolicyOptions
    {
        MinimumSameSitePolicy = SameSiteMode.None,
    });

    app.UseMvc();
}

In the above code snippet, we are setting up a cookie policy for an ASP.NET Core application.

The CookiePolicyOptions object is used to configure the behavior of cookies in the application. In this case, we are setting the MinimumSameSitePolicy to SameSiteMode.None, which means that cookies will be allowed to be sent with both same-site and cross-site requests.

However, the Secure attribute is not set for the cookies. The Secure attribute is a flag that can be included in a Set-Cookie HTTP response header. The presence of this flag indicates that the cookie should only be sent over secure channels such as HTTPS.

By not setting the Secure attribute, the application allows the cookies to be sent over insecure channels, which could expose sensitive information to potential attackers. This is a serious security vulnerability as it can lead to session hijacking or man-in-the-middle attacks.

Steps​

  • Set the Secure attribute for sensitive cookies.
  • Ensure that the cookies are only sent over a secure channel (HTTPS).
  • Update the code to configure the CookiePolicyOptions with the Secure attribute.
  • Test the application to ensure that the cookies are now being generated securely.

Compliant code​

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseCookiePolicy(new CookiePolicyOptions
    {
        MinimumSameSitePolicy = SameSiteMode.None,
        Secure = CookieSecurePolicy.Always
    });

    app.UseMvc();
}

The updated code now includes the Secure attribute in the CookiePolicyOptions configuration. This attribute is set to CookieSecurePolicy.Always, which means that the cookies will always be sent over a secure channel (HTTPS).

This change ensures that sensitive cookies are not sent over an insecure channel, thereby mitigating the risk of cookie theft and other potential security issues. After implementing this change, it's important to test the application to ensure that the cookies are now being generated securely.

References​

Last updated on