Insecurely generated cookies - HttpOnly
Need
To protect cookies from being accessed by client-side scripts
Context
- Usage of Elixir for building scalable and fault-tolerant applications
- Usage of Plug Cowboy for building web applications in Elixir
- Usage of secure cookie handling for session management
Description
Non compliant code
defmodule Vulnerable do
use Plug.Router
plug :match
plug :dispatch
post "" do
conn
|> put_resp_cookie("sensitive_info", "some_value")
|> send_resp(200, "OK")
end
match _ do
send_resp(conn, 404, "Not found")
end
end
In this Elixir code snippet, a cookie is being set without the HttpOnly attribute, making it susceptible to being read by client-side scripts.
Steps
- Set the HttpOnly attribute to true while setting the cookies.
- Do not store sensitive information in cookies if possible.
Compliant code
defmodule Secure do
use Plug.Router
plug :match
plug :dispatch
post "" do
conn
|> put_resp_cookie("sensitive_info", "some_value", http_only: true)
|> send_resp(200, "OK")
end
match _ do
send_resp(conn, 404, "Not found")
end
end
In this Elixir code snippet, the cookie is set with the HttpOnly attribute set to true, protecting it from being read by client-side scripts.