Skip to main content

Insecurely generated cookies - SameSite

Need​

Secure generation of cookies with proper SameSite attribute

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for developing Java Servlet applications

Description​

Non compliant code​

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;

public void createCookie(HttpServletResponse response) {
    Cookie cookie = new Cookie("user", "123");
    response.addCookie(cookie);
}

The above code represents a method that creates a cookie and adds it to the HTTP response without setting the SameSite attribute.

The createCookie method first creates a new Cookie object with the name "user" and value "123". It then adds this cookie to the HttpServletResponse object. However, it does not set the SameSite attribute for the cookie.

The SameSite attribute is an effective measure to protect cookies from Cross-Site Request Forgery (CSRF) attacks. It determines whether cookies are sent along with cross-site requests. The attribute can have three values:

  • Strict: The cookie will not be sent along with cross-site requests.
  • Lax: The cookie will be sent with top-level navigations and will be sent with GET method navigations.
  • None: The cookie will be sent with all requests.

By not setting the SameSite attribute, the application allows the browser to send the cookie along with all cross-site requests. This could potentially expose the application to CSRF attacks, where an attacker tricks a victim's browser into making a request to the application with the victim's cookies.

Steps​

  • Set the SameSite attribute of the cookie to 'Strict' or 'Lax'.
  • Use a secure flag to ensure the cookie is only sent over HTTPS.
  • Set an appropriate expiration date for the cookie.
  • Use a secure random number generator to generate the cookie value.
  • Implement proper input validation and sanitization to prevent any potential injection attacks.
  • Regularly update and patch the libraries and frameworks used in the application to ensure they are not vulnerable to any known security issues.

Compliant code​

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;

public void createCookie(HttpServletResponse response) {
    Cookie cookie = new Cookie("user", "123");
    cookie.setSecure(true); // Set secure flag to true
    cookie.setHttpOnly(true); // Set HttpOnly flag to true
    cookie.setMaxAge(60 * 60 * 24); // Set expiration date to 24 hours
    response.addCookie(cookie);
}

The updated code now includes several security measures to ensure the cookie is generated securely.

  1. cookie.setSecure(true); - This line sets the secure flag of the cookie to true. This means the cookie will only be sent over secure connections, i.e., HTTPS. This helps to prevent man-in-the-middle attacks where an attacker might intercept the cookie over an insecure connection.

  2. cookie.setHttpOnly(true); - This line sets the HttpOnly flag of the cookie to true. This means the cookie cannot be accessed through client-side scripts. This helps to prevent cross-site scripting (XSS) attacks where an attacker might try to access the cookie through a malicious script.

  3. cookie.setMaxAge(60 * 60 * 24); - This line sets the expiration date of the cookie to 24 hours. This means the cookie will automatically expire after 24 hours. This helps to limit the potential damage if an attacker manages to steal the cookie, as they will only have a limited time to use it.

Please note that the value of the cookie ("123") is still hardcoded in this example. In a real-world application, you should use a secure random number generator to generate the cookie value. This helps to prevent brute-force attacks where an attacker might try to guess the cookie value.

Also, remember to implement proper input validation and sanitization to prevent any potential injection attacks. Regularly update and patch the libraries and frameworks used in the application to ensure they are not vulnerable to any known security issues.

References​

Last updated on