Stephen Evans: /* Reviewer comments */

2008-10-22T07:57:45Z

‎Reviewer comments

Stephen Evans: added content

2008-10-22T07:13:13Z

added content

New page

8. Cross-Site Scripting (XSS) -> 8.6 HTTPOnly Test

(This sublesson was not formally solved by the project)

=== Lesson overview ===

The WebGoat lesson overview is included with the WebGoat lesson solution.

=== Lesson solution ===

Refer to the zip file with the WebGoat lesson solutions. See Appendix A for more information.

=== Strategy ===

This WebGoat lesson is a demonstration of the HttpOnly flag which prevents client side script from reading a cookie value if it is set; "Read Cookie" and "Write Cookie" buttons can be selected to view that particular browser's support of the HttpOnly flag.

There really is no ModSecurity solution or any other way to illustrate similar functionality within ModSecurity, especially since this takes place in the browser and ModSecurity cannot modify source code in an HTTP response.

=== Reviewer comments ===

For this lesson, ModSecurity rules can be implemented to inspect Response Headers and look for Set-Cookie data. When we see it, we can create an Application Defect alert if it is missing the HttpOnly flag:

<pre>
SecRule RESPONSE_HEADERS:/Set-Cookie2?/ "!(?:\;? ?httponly;?)" \ "phase:3,t:none,t:lowercase,pass,log,auditlog, \
msg:'AppDefect: Missing HttpOnly Cookie Flag.'"
</pre>

@@ Line 22: / Line 22: @@
 <pre>
-SecRule RESPONSE_HEADERS:/Set-Cookie2?/ "!(?:\;? ?httponly;?)" \ "phase:3,t:none,t:lowercase,pass,log,auditlog, \
+SecRule RESPONSE_HEADERS:/Set-Cookie2?/ "!(?:\;? ?httponly;?)" \
 msg:'AppDefect: Missing HttpOnly Cookie Flag.'"
 </pre>

OWASP ModSecurity Securing WebGoat Section4 Sublesson 08.6 - Revision history

Stephen Evans: /* Reviewer comments */

Stephen Evans: added content