Skip to main content

Insecurely generated cookies

Need​

Secure generation and handling of cookies

Context​

  • Usage of TypeScript for static typing and enhanced developer experience in Node.js development
  • Usage of Express for building web applications and APIs

Description​

Non compliant code​

import express from 'express';

const app = express();

app.get('/', (req, res) => {
  res.cookie('session', '1234567890');
  res.send('Hello World!');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The vulnerability in this code is that it insecurely generates cookies.

In the code, the res.cookie() function is used to set a cookie named 'session' with the value '1234567890'. However, the code does not set any security attributes for this cookie.

When cookies are generated without proper security attributes, they can be vulnerable to attacks such as interception or disclosure by unauthorized users. This means that the session cookie, which is used to authenticate and track user sessions, can be sent in plain text over insecure channels, making it easier for attackers to capture and exploit the cookie.

To fix this vulnerability, the application should set the corresponding security attributes when generating cookies. This includes setting the 'secure' attribute to ensure that the cookie is only sent over HTTPS, and the 'httpOnly' attribute to prevent client-side scripts from accessing the cookie. Additionally, setting the 'sameSite' attribute to 'strict' or 'lax' can provide further protection against cross-site request forgery (CSRF) attacks.

Steps​

  • Import the 'cookie-parser' middleware library
  • Use the 'cookie-parser' middleware to parse cookies in the request
  • Set the 'secure' attribute to true when setting the session cookie
  • Set the 'httpOnly' attribute to true when setting the session cookie
  • Set the 'sameSite' attribute to 'strict' when setting the session cookie
  • Consider using a secure connection (HTTPS) to transmit the session cookie

Compliant code​

import express from 'express';
import cookieParser from 'cookie-parser';

const app = express();

app.use(cookieParser());

app.get('/', (req, res) => {
  res.cookie('session', '1234567890', {
    secure: true,
    httpOnly: true,
    sameSite: 'strict'
  });
  res.send('Hello World!');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The fixed code addresses the vulnerability by securely generating cookies with the appropriate security attributes.

First, the code imports the necessary modules, including Express and cookie-parser, which is used to parse cookies in the incoming requests.

Next, an Express application is created using the express() function.

The cookieParser() middleware is added to the application using the app.use() method. This middleware parses the cookies in the incoming requests and makes them available in the req.cookies object.

A route handler is defined for the root path ("/") using the app.get() method. Inside the route handler, a secure session cookie is generated using the res.cookie() method.

The res.cookie() method takes three arguments: the name of the cookie, the value of the cookie, and an options object. In this case, the cookie name is set to "session" and the value is set to "1234567890".

The options object is used to set the security attributes of the cookie. The secure attribute is set to true, which ensures that the cookie is only sent over secure (HTTPS) connections. The httpOnly attribute is set to true, which prevents client-side JavaScript from accessing the cookie. The sameSite attribute is set to "strict", which restricts the cookie to be sent only with requests originating from the same site.

Finally, the response is sent with the message "Hello World!" using the res.send() method.

The application is then set to listen on port 3000 using the app.listen() method, and a message is logged to the console indicating that the server is running.

Overall, this fixed code ensures that the session cookie is securely generated with the appropriate security attributes, addressing the vulnerability of insecurely generated cookies.

References​

Last updated on