Skip to main content

Insecurely generated cookies - Secure

Need​

Secure generation and transmission of cookies

Context​

  • Usage of Ruby 2.5 for developing Ruby applications
  • Usage of ActionPack for handling web requests and generating responses in Ruby on Rails

Description​

Non compliant code​

class ApplicationController < ActionController::Base
  def set_cookie
    cookies[:user] = { value: "XJ12", expires: 1.year.from_now }
  end
end

The above code snippet is a controller in a Ruby on Rails application. It sets a cookie named user with a value of XJ12 and an expiration date of 1 year from the current time.

The vulnerability lies in the fact that the Secure attribute is not set for the cookie. The Secure attribute is a flag that can be included when the server sends a new cookie to the user within an HTTP response. When the Secure attribute is set, the cookie will only be sent over secure channels, i.e., it will only be included in HTTPS requests.

In the provided code, since the Secure attribute is not set, the cookie will be included in all requests regardless of whether the connection is secure or not. This means that if an attacker is able to intercept these HTTP requests, they could potentially steal sensitive information contained in the cookies.

This is a significant security vulnerability because it can lead to unauthorized access and potential data breaches.

Steps​

  • Set the Secure attribute for sensitive cookies.
  • Ensure that the application is using HTTPS to transmit cookies.
  • Verify that the cookies are being used for sensitive data and not for non-sensitive information.
  • Consider using the HttpOnly attribute for sensitive cookies to prevent client-side script access.
  • Regularly review and update the cookie settings to ensure they align with security best practices.

Compliant code​

class ApplicationController < ActionController::Base
  def set_cookie
    cookies[:user] = { value: "XJ12", expires: 1.year.from_now, secure: Rails.env.production?, httponly: true }
  end
end

The updated code now sets the Secure attribute for the cookie. This attribute ensures that the cookie will only be sent over an HTTPS connection, which is encrypted. This prevents the cookie from being intercepted and read by an attacker who is listening on the network.

The secure: Rails.env.production? line of code ensures that the Secure attribute is only set when the application is running in a production environment. This is because HTTPS is typically not used in development or test environments.

In addition to setting the Secure attribute, the code also sets the HttpOnly attribute for the cookie. This attribute prevents client-side scripts from accessing the cookie. This can help to mitigate the risk of certain types of attacks, such as cross-site scripting (XSS) attacks, which can be used to steal cookies and hijack user sessions.

It's important to regularly review and update the cookie settings to ensure they align with security best practices. This includes ensuring that cookies are only used for sensitive data and not for non-sensitive information.

References​

Last updated on