HttpOnly - Revision history

Markgordon: Corrected a spelling error

2017-08-24T20:02:30Z

Corrected a spelling error

Wichers at 14:36, 28 March 2017

2017-03-28T14:36:31Z

Show changes

Wichers: /* References */

2017-03-28T14:17:43Z

‎References

Wichers at 14:16, 28 March 2017

2017-03-28T14:16:42Z

Jmanico: adding websphere

2014-11-12T06:08:29Z

adding websphere

Ali Khalfan: edit syntax of

2014-01-21T18:21:53Z

edit syntax of </session-config>

Tarin Gamberini at 14:35, 16 January 2013

2013-01-16T14:35:49Z

Tarin Gamberini: clarified differences between JEE 6 and JEE 5

2013-01-16T13:19:14Z

clarified differences between JEE 6 and JEE 5

Tarin Gamberini: improved HttpOnly via application server configuration JEE 5

2013-01-16T11:59:40Z

improved HttpOnly via application server configuration JEE 5

Tarin Gamberini: httponly through web.xml moved up near JEE 6

2013-01-16T11:18:07Z

httponly through web.xml moved up near JEE 6

@@ Line 3: / Line 3: @@
 The goal of this section is to introduce, discuss, and provide language specific mitigation techniques for HttpOnly.
-<h3 style=color:#4682B4> <u> Who developed HttpOnly? When? </u> </h3>
+<h3 style="color:#4682B4"> <u> Who developed HttpOnly? When? </u> </h3>
 According to a daily blog article by [http://www.networkcomputing.com/careers/no-cookie-you/1270585242 Jordan Wiens, “No cookie for you!”], HttpOnly cookies were first implemented in 2002 by Microsoft Internet Explorer developers for Internet Explorer 6 SP1.
-<h3 style=color:#4682B4> <u> What is HttpOnly? </u> </h3>
+<h3 style="color:#4682B4"> <u> What is HttpOnly? </u> </h3>
 According to the [http://msdn2.microsoft.com/en-us/library/ms533046.aspx Microsoft Developer Network], HttpOnly is an ''additional flag'' included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).
@@ Line 21: / Line 21: @@
 If a browser does not support HttpOnly and a website attempts to set an HttpOnly cookie, the HttpOnly flag will be ignored by the browser, thus creating a traditional, script accessible cookie. As a result, the cookie (typically your session cookie) becomes vulnerable to theft of modification by malicious script. [http://msdn2.microsoft.com/en-us/library/ms533046.aspx Mitigating].
-<h3 style=color:#4682B4> <u>Mitigating the Most Common XSS attack using HttpOnly</u> </h3>
+<h3 style="color:#4682B4"> <u>Mitigating the Most Common XSS attack using HttpOnly</u> </h3>
 According to [http://msdn2.microsoft.com/en-us/library/ms972826.aspx Michael Howard], Senior Security Program Manager in the Secure Windows Initiative group at Microsoft, the majority of XSS attacks target theft of session cookies. A server could help mitigate this issue by setting the HttpOnly flag on a cookie it creates, indicating the cookie should not be accessible on the client.
@@ Line 27: / Line 27: @@
 If a browser that supports HttpOnly detects a cookie containing the HttpOnly flag, and client side script code attempts to read the cookie, the browser ''returns an empty string'' as the result. This causes the attack to fail by preventing the malicious (usually XSS) code from sending the data to an attacker's website.
-<h5 style=color:#2E8B57> <u>Using Java to Set HttpOnly</u> </h5>
+<h5 style="color:#2E8B57"> <u>Using Java to Set HttpOnly</u> </h5>
 Since Java Enterprise Edition 6 (JEE 6), which adopted Java Servlet 3.0 technology, it's programmatically easy to set the HttpOnly flag on a cookie.
@@ Line 47: / Line 47: @@
   response.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; HttpOnly");
-In this context, overwriting, despite appropriate for the <code>HttpOnly</code> flag, is discouraged because the JSESSIONID may have been set with other flags. A better workaround is taking care of the previously set flags or using the [[ESAPI#Java_EE]] library: in fact the <code>addCookie</code> method of the <code>SecurityWrapperResponse</code> [http://code.google.com/p/owasp-esapi-java/source/browse/tags/esapi-2.0.1/src/main/java/org/owasp/esapi/filters/SecurityWrapperResponse.java] takes care of previously set falgs for us. So we could write a servlet filter as the following one:
+In this context, overwriting, despite appropriate for the <code>HttpOnly</code> flag, is discouraged because the JSESSIONID may have been set with other flags. A better workaround is taking care of the previously set flags or using the [[ESAPI#Java_EE]] library: in fact the <code>addCookie</code> method of the <code>SecurityWrapperResponse</code> [http://code.google.com/p/owasp-esapi-java/source/browse/tags/esapi-2.0.1/src/main/java/org/owasp/esapi/filters/SecurityWrapperResponse.java] takes care of previously set flags for us. So we could write a servlet filter as the following one:
   public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
       HttpServletRequest httpServletRequest = (HttpServletRequest) request;
@@ Line 79: / Line 79: @@
 * <b>IBM Websphere</b> offer HTTPOnly for session cookies as a configuration option.
-[http://pic.dhe.ibm.com/infocenter/tivihelp/v33r1/topic/com.ibm.mam.inswas.doc/install/t_configuringthehttponlyattribute.html http://pic.dhe.ibm.com/infocenter/tivihelp/v33r1/topic/com.ibm.mam.inswas.doc/install/t_configuringthehttponlyattribute.html]
+http://pic.dhe.ibm.com/infocenter/tivihelp/v33r1/topic/com.ibm.mam.inswas.doc/install/t_configuringthehttponlyattribute.html
-<h5 style=color:#2E8B57> <u>Using .NET to Set HttpOnly</u> </h5>
+<h5 style="color:#2E8B57"> <u>Using .NET to Set HttpOnly</u> </h5>
 *By ''default'', '''.NET 2.0''' sets the HttpOnly attribute for
@@ Line 106: / Line 106: @@
   Response.Cookies[cookie].Path += ";HttpOnly";
-<h5 style=color:#2E8B57> <u>Using Python (cherryPy) to Set HttpOnly</u> </h5>
+<h5 style="color:#2E8B57"> <u>Using Python (cherryPy) to Set HttpOnly</u> </h5>
 Python Code (cherryPy):<br>
@@ Line 114: / Line 114: @@
   tools.sessions.secure = True<br>
-<h5 style=color:#2E8B57> <u> Using PHP to set HttpOnly </u> </h5>
+<h5 style="color:#2E8B57"> <u> Using PHP to set HttpOnly </u> </h5>
 PHP supports setting the HttpOnly flag since version 5.2.0 (November 2006).
@@ Line 140: / Line 140: @@
 Our results as of Feb 2009 are listed below in '''table 1'''.
-{|border="2" width="100%" align="center"
+{| width="100%" border="2" align="center"
 |+ '''Table 1:''' Browsers Supporting HttpOnly
 |-
@@ Line 249: / Line 249: @@
 The goal of this section is to provide a step-by-step example of testing your browser for HttpOnly support.
-<h3 style=color:#4682B4> <u> WARNING</u> </h3>
+<h3 style="color:#4682B4"> <u> WARNING</u> </h3>
-The OWASP WEBGOAT HttpOnly lab is broken and does not show IE 8 Beta 2 with ms08-069 as complete in terms of HttpOnly XMLHTTPRequest header leakage protection. This error is being tracked via [http://code.google.com/p/webgoat/issues/detail?id=18 http://code.google.com/p/webgoat/issues/detail?id=18].
+The OWASP WEBGOAT HttpOnly lab is broken and does not show IE 8 Beta 2 with ms08-069 as complete in terms of HttpOnly XMLHTTPRequest header leakage protection. This error is being tracked via http://code.google.com/p/webgoat/issues/detail?id=18.
-<h3 style=color:#4682B4> <u> Getting Started </u> </h3>
+<h3 style="color:#4682B4"> <u> Getting Started </u> </h3>
 [[Image:Click_link.JPG|thumb|175px|right|Figure 1 - Accessing WebGoat's HttpOnly Test Lesson]]
@@ Line 259: / Line 259: @@
 Assuming you have installed and launched WebGoat, begin by navigating to the '''‘HttpOnly Test’ lesson''' located within the Cross-Site Scripting ('''XSS''') category. After loading the ‘HttpOnly Test’ lesson, as shown in '''figure 1''', you are now able to begin testing web browsers supporting HttpOnly.
-<h3 style=color:#4682B4> <u> Lesson Goal </u> </h3>
+<h3 style="color:#4682B4"> <u> Lesson Goal </u> </h3>
 If the ''HttpOnly flag'' is set, then your browser should not allow a client-side script to access the session cookie. Unfortunately, since the attribute is relatively new, several browsers may neglect to handle the new attribute properly.
@@ Line 265: / Line 265: @@
 The '''purpose''' of this lesson is to test whether your browser supports the '''HttpOnly cookie flag'''. ''Note the value of the'' '''''unique2u cookie'''''. If your browser supports HttpOnly, and you ''enable'' it for a cookie, a client-side script should NOT be able to read OR write to that cookie, but the browser can still send its value to the server. However, some browsers only prevent client side read access, but do not prevent write access.
-<h3 style=color:#4682B4> <u> Testing Web Browsers for HttpOnly Support </u> </h3>
+<h3 style="color:#4682B4"> <u> Testing Web Browsers for HttpOnly Support </u> </h3>
 The following test was performed on two browsers, '''Internet Explorer 7''' and '''Opera 9.22''', to demonstrate the results when the HttpOnly flag is enforced properly. As you will see, IE7 properly enforces the HttpOnly flag, whereas Opera does not properly enforce the HttpOnly flag.
-<h5 style=color:#2E8B57> <u> Disabling HttpOnly </u> </h5>
+<h5 style="color:#2E8B57"> <u> Disabling HttpOnly </u> </h5>
 ) Select the option to '''turn HttpOnly off''' as shown below in '''figure 2'''.
@@ Line 288: / Line 288: @@
 *As you have seen thus far, '''browsing without HttpOnly''' on is a potential '''''threat'''''. Next, we will '''enable HttpOnly''' to demonstrate how this flag protects the cookie.
-<h5 style=color:#2E8B57> <u> Enabling HttpOnly </u> </h5>
+<h5 style="color:#2E8B57"> <u> Enabling HttpOnly </u> </h5>
 ) Select the ''radio button'' to enable HttpOnly as shown below in '''figure 5'''.
@@ Line 325: / Line 325: @@
 # [http://seckb.yehg.net/2012/06/xss-gaining-access-to-httponly-cookie.html XSS: Gaining access to HttpOnly Cookie in 2012]
 # [http://stackoverflow.com/questions/13147113/setting-an-httponly-cookie-with-javax-servlet-2-5 Setting HttpOnly in Java]

@@ Line 321: / Line 321: @@
 [1] [https://cwe.mitre.org/data/definitions/1004.html CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag]
-[2] Wiens, Jordan. [http://www.networkcomputing.com/blog/dailyblog/archives/2007/03/no_cookie_for_y.html No cookie for you!"]
+[2] [http://msdn2.microsoft.com/en-us/library/ms533046.aspx Mitigating Cross-site Scripting with HTTP-Only Cookies]
-[3] [http://msdn2.microsoft.com/en-us/library/ms533046.aspx Mitigating Cross-site Scripting with HTTP-Only Cookies]
+[3] Howard, Michael. [http://msdn2.microsoft.com/en-us/library/ms972826.aspx Some Bad News and Some Good News]
-[4] Howard, Michael. [http://msdn2.microsoft.com/en-us/library/ms972826.aspx Some Bad News and Some Good News]
+[4] MSDN. [http://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx Setting the HttpOnly propery in .NET]
-[5] MSDN. [http://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx Setting the HttpOnly propery in .NET]
+[5] [http://seckb.yehg.net/2012/06/xss-gaining-access-to-httponly-cookie.html XSS: Gaining access to HttpOnly Cookie in 2012]

@@ Line 319: / Line 319: @@
 == References ==
-[1] Wiens, Jordan. [http://www.networkcomputing.com/blog/dailyblog/archives/2007/03/no_cookie_for_y.html No cookie for you!"]
+[1] [https://cwe.mitre.org/data/definitions/1004.html CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag]
-[2] [http://msdn2.microsoft.com/en-us/library/ms533046.aspx Mitigating Cross-site Scripting with HTTP-Only Cookies]
+[2] Wiens, Jordan. [http://www.networkcomputing.com/blog/dailyblog/archives/2007/03/no_cookie_for_y.html No cookie for you!"]
-[3] Howard, Michael. [http://msdn2.microsoft.com/en-us/library/ms972826.aspx Some Bad News and Some Good News]
+[3] [http://msdn2.microsoft.com/en-us/library/ms533046.aspx Mitigating Cross-site Scripting with HTTP-Only Cookies]
-[4] MSDN. [http://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx Setting the HttpOnly propery in .NET]
+[4] Howard, Michael. [http://msdn2.microsoft.com/en-us/library/ms972826.aspx Some Bad News and Some Good News]
-[5] [http://seckb.yehg.net/2012/06/xss-gaining-access-to-httponly-cookie.html XSS: Gaining access to HttpOnly Cookie in 2012]
+[5] MSDN. [http://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx Setting the HttpOnly propery in .NET]

@@ Line 78: / Line 78: @@
   <Context cookies="true" crossContext="true">
     <SessionCookie secure="true" httpOnly="true" />
 <h5 style=color:#2E8B57> <u>Using .NET to Set HttpOnly</u> </h5>

@@ Line 41: / Line 41: @@
     &lt;http-only&gt;true&lt;/http-only&gt;
    &lt;/cookie-config>
-  &lt;session-config&gt;
+  &lt;/session-config&gt;
 For Java Enterprise Edition versions ''prior'' to JEE 6 a common '''workaround''' is to overwrite the <code>SET-COOKIE</code> http response header with a session cookie value that explicitly appends the <code>HttpOnly</code> flag:

@@ Line 43: / Line 43: @@
   &lt;session-config&gt;
-For Java Enterprise Edition versions ''prior'' to JEE 6 a common '''workaround''' is to overwrite the <code>SET-COOKIE</code> http response header with a session cookie value that explicitly append the <code>HttpOnly</code> flag:
+For Java Enterprise Edition versions ''prior'' to JEE 6 a common '''workaround''' is to overwrite the <code>SET-COOKIE</code> http response header with a session cookie value that explicitly appends the <code>HttpOnly</code> flag:
   String sessionid = request.getSession().getId();
   // be careful overwriting: JSESSIONID may have been set with other flags

@@ Line 30: / Line 30: @@
 <h5 style=color:#2E8B57> <u>Using Java to Set HttpOnly</u> </h5>
-Since Sun Java Enterprise Edition 6 (JEE 6) it's programmatically easy setting ''HttpOnly'' flag in a cookie.
+Since Sun Java Enterprise Edition 6 (JEE 6), that adopted Java Servlet 3.0 technology, it's programmatically easy setting HttpOnly flag in a cookie.
-In fact methods ''setHttpOnly'' and ''isHttpOnly'' are available in the ''Cookie'' interface [http://java.sun.com/javaee/6/docs/api/javax/servlet/http/Cookie.html#setHttpOnly%28boolean%29], and also for session cookies (JSESSIONID) [http://java.sun.com/javaee/6/docs/api/javax/servlet/SessionCookieConfig.html#setHttpOnly%28boolean%29]:
+In fact <code>setHttpOnly</code> and <code>isHttpOnly</code> methods are available in the <code>Cookie</code> interface [http://java.sun.com/javaee/6/docs/api/javax/servlet/http/Cookie.html#setHttpOnly%28boolean%29], and also for session cookies (JSESSIONID) [http://java.sun.com/javaee/6/docs/api/javax/servlet/SessionCookieConfig.html#setHttpOnly%28boolean%29]:
   Cookie cookie = getMyCookie("myCookieName");
   cookie.setHttpOnly(true);
-Moreover it's declaratively easy setting ''HttpOnly'' flag in a cookie too, by applying the following configuration in the deployment descriptor ''web.xml'':
+Moreover since JEE 6 it's also declaratively easy setting <code>HttpOnly</code> flag in session cookie, by applying the following configuration in the deployment descriptor <code>WEB-INF/web.xml</code>:
   &lt;session-config&gt;
    &lt;cookie-config&gt;
@@ Line 43: / Line 43: @@
   &lt;session-config&gt;
-For older Java Enterprise Edition versions a common '''workaround''' is to overwrite the ''SET-COOKIE'' http response header with a session cookie value that explicitly append the ''HttpOnly'' flag:
+For Java Enterprise Edition versions ''prior'' to JEE 6 a common '''workaround''' is to overwrite the <code>SET-COOKIE</code> http response header with a session cookie value that explicitly append the <code>HttpOnly</code> flag:
   String sessionid = request.getSession().getId();
   // be careful overwriting: JSESSIONID may have been set with other flags
   response.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; HttpOnly");
-In this context the overwriting, despite being good for ''HttpOnly'', is discouraged because JSESSIONID may have been set with other flags. So a better workaround is taking care of the previously set flags or using the [[ESAPI#Java_EE]] library: in fact the ''addCookie'' methods of the ''SecurityWrapperResponse'' [http://code.google.com/p/owasp-esapi-java/source/browse/tags/esapi-2.0.1/src/main/java/org/owasp/esapi/filters/SecurityWrapperResponse.java] takes care of previously set falgs for us. So we could write a servlet filter as the following one:
+In this context overwriting, despite appropriate for the <code>HttpOnly</code> flag, is discouraged because JSESSIONID may have been set with other flags. So a better workaround is taking care of the previously set flags or using the [[ESAPI#Java_EE]] library: in fact the <code>addCookie</code> method of the <code>SecurityWrapperResponse</code> [http://code.google.com/p/owasp-esapi-java/source/browse/tags/esapi-2.0.1/src/main/java/org/owasp/esapi/filters/SecurityWrapperResponse.java] takes care of previously set falgs for us. So we could write a servlet filter as the following one:
   public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
       HttpServletRequest httpServletRequest = (HttpServletRequest) request;
@@ Line 69: / Line 69: @@
+  }
-Some web application servers that implements JEE 5 allow creating ''HttpOnly'' session cookies:
+Some web application servers, that implements JEE 5, and servlet container that implements Java Servlet 2.5 (part of the JEE 5), also allow creating HttpOnly session cookies:
-* '''Tomcat 6''' In ''context.xml'' set the ''context'' tag's attribute ''useHttpOnly'' [http://tomcat.apache.org/tomcat-6.0-doc/config/context.html#Common_Attributes] as follow:
+* '''Tomcat 6''' In <code>context.xml</code> set the <code>context</code> tag's attribute <code>useHttpOnly</code> [http://tomcat.apache.org/tomcat-6.0-doc/config/context.html#Common_Attributes] as follow:
   <?xml version="1.0" encoding="UTF-8"?>
   <Context path="/myWebApplicationPath" useHttpOnly="true">
-* '''JBoss 5.0.1''' and '''JBOSS EAP 5.0.1''' In ''\server\<myJBossServerInstance>\deploy\jbossweb.sar\context.xml'' set the ''SessionCookie'' tag [https://community.jboss.org/message/598558#598558] as follow:
+* '''JBoss 5.0.1''' and '''JBOSS EAP 5.0.1''' In <code>\server\<myJBossServerInstance>\deploy\jbossweb.sar\context.xml</code> set the <code>SessionCookie</code> tag [https://community.jboss.org/message/598558#598558] as follow:
   <Context cookies="true" crossContext="true">
     <SessionCookie secure="true" httpOnly="true" />

@@ Line 35: / Line 35: @@
   Cookie cookie = getMyCookie("myCookieName");
   cookie.setHttpOnly(true);
 For older Java Enterprise Edition versions a common workaround is to overwrite the ''SET-COOKIE'' http response header with a session cookie value that explicitly append the ''HttpOnly'' flag:
@@ Line 63: / Line 71: @@
 In '''Tomcat 6''' flag ''useHttpOnly=True'' in context.xml to force this behaviour for applications[http://tomcat.apache.org/tomcat-6.0-doc/config/context.html], including Tomcat-based frameworks like JBoss[http://www.jboss.org/feeds/post/httponly_cookies_in_tomcat_jboss].
 <h5 style=color:#2E8B57> <u>Using .NET to Set HttpOnly</u> </h5>