SecureFlag - Revision history

Nawwar: /* ASP.NET */ Update ASP.NET section with more details and an alternative example.

2019-04-30T18:33:14Z

‎ASP.NET: Update ASP.NET section with more details and an alternative example.

Dan Wallis at 04:08, 27 July 2017

2017-07-27T04:08:52Z

Dan Wallis: /* Related Articles */

2017-07-27T04:07:36Z

‎Related Articles

Paco at 18:10, 28 July 2016

2016-07-28T18:10:31Z

Zerosum0x0: Added PHP

2015-12-14T18:34:46Z

Added PHP

Bill Sempf at 20:35, 14 August 2014

2014-08-14T20:35:06Z

James Jardine: Updated the ASP.Net section to correctly identify the secure flag, instead of the HTTPOnly flag.

2014-01-07T18:45:16Z

Updated the ASP.Net section to correctly identify the secure flag, instead of the HTTPOnly flag.

Wichers at 15:39, 20 December 2013

2013-12-20T15:39:36Z

Bill Sempf: Fixed bug in Java config

2013-11-03T01:47:06Z

Fixed bug in Java config

Gladwin at 20:13, 9 January 2013

2013-01-09T20:13:05Z

@@ Line 48: / Line 48: @@
 <httpCookies requireSSL="true" />
-For some objects that have a requireSSL property, like the forms Authentication Cookie, set the requireSSL="true" flag in the web.config for that specific element.
+For some objects that have a requireSSL property, like the forms Authentication Cookie, set the requireSSL="true" flag in the ''web.config'' for that specific element. For example:
 == PHP ==

← Older revision		Revision as of 04:08, 27 July 2017
Line 70:		Line 70:

	[[Category:Control]]		[[Category:Control]]
−	~~[[Category:FixME/old]]~~

@@ Line 66: / Line 66: @@
 = Related Articles =
+* [[Testing for cookies attributes (OTG-SESS-002)|Testing for Cookie Attributes]]
-[http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002) Testing for Cookie Attributes]<br>
+* http://www.troyhunt.com/2011/11/owasp-top-10-for-net-developers-part-9.html
 [[Category:Control]]
-[[Cateogyr:FixME/old]]
+[[Category:FixME/old]]

@@ Line 1: / Line 1: @@
 = Overview =
 The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP&nbsp;Response. The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a the cookie in clear text.<br>
-To accomplish this goal, browsers which support the secure flag will only send cookies with the secure flag when the request is going to a HTTPS page. Said in another way, the browser will not send a cookie with the secure flag set over an unencrypted HTTP&nbsp;request.<br>
+To accomplish this goal, browsers which support the secure flag will only send cookies with the secure flag when the request is going to a HTTPS page. Said in another way, the browser will not send a cookie with the secure flag set over an unencrypted HTTP request.<br>
 By setting the secure flag, the browser will prevent the transmission of a cookie over an unencrypted channel.<br>
@@ Line 65: / Line 71: @@
 [[Category:Control]]

← Older revision		Revision as of 18:34, 14 December 2015
Line 43:		Line 43:

	For some objects that have a requireSSL property, like the forms Authentication Cookie, set the requireSSL="true" flag in the web.config for that specific element.		For some objects that have a requireSSL property, like the forms Authentication Cookie, set the requireSSL="true" flag in the web.config for that specific element.
		+
		+	== PHP ==
		+
		+	For session cookies managed by PHP, the flag is set either permanently in php.ini [http://php.net/manual/en/session.configuration.php#ini.session.cookie-secure PHP manual on ''SecureFlag''] through the parameter:
		+	session.cookie_secure = True
		+	or in and during a script via the function [http://pl.php.net/manual/en/function.session-set-cookie-params.php]:
		+	void session_set_cookie_params ( int $lifetime [, string $path [, string $domain
		+	[, bool $secure= false [, bool $httponly= false ]]]] )
		+	For application cookies a parameter in setcookie() sets Secure flag [http://pl.php.net/setcookie]:
		+	bool setcookie ( string $name [, string $value [, int $expire= 0 [, string $path
		+	[, string $domain [, bool $secure= false [, bool $httponly= false ]]]]]] )

	= Testing for the Secure Flag =		= Testing for the Secure Flag =

← Older revision		Revision as of 20:35, 14 August 2014
Line 52:		Line 52:
	[http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002) Testing for Cookie Attributes]<br>		[http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002) Testing for Cookie Attributes]<br>
	http://www.troyhunt.com/2011/11/owasp-top-10-for-net-developers-part-9.html		http://www.troyhunt.com/2011/11/owasp-top-10-for-net-developers-part-9.html
		+
		+	[[Category:Control]]

@@ Line 42: / Line 42: @@
 <httpCookies requireSSL="true" />
-By default, the .NET session cookie has this flag set already.
+For some objects that have a requireSSL property, like the forms Authentication Cookie, set the requireSSL="true" flag in the web.config for that specific element.
 = Testing for the Secure Flag =
-Verifying that a web site sets this flag on any particular cookie is easy. Using an intercepting proxy, like [[ZAP]], you can capture each response from the server and examine any Set-Cookie headers it includes to see if the HTTPOnly flag is set on the cookie.
+Verifying that a web site sets this flag on any particular cookie is easy. Using an intercepting proxy, like [[ZAP]], you can capture each response from the server and examine any Set-Cookie headers it includes to see if the secure flag is set on the cookie.
 = Related Articles =

@@ Line 1: / Line 1: @@
-{{Stub}}
+= Overview =
 The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP&nbsp;Response. The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a the cookie in clear text.<br>
@@ Line 12: / Line 10: @@
 Following sections describes setting the Secure Flag in respective technologies.
 == Java ==
@@ Line 39: / Line 36: @@
 With this flag always set, sessions won't work in environments(development/test/etc.) that may use http. SessionCookieConfig [http://java.sun.com/javaee/6/docs/api/javax/servlet/SessionCookieConfig.html#setSecure%28boolean%29] interface or setting custom header[https://www.owasp.org/index.php/SecureFlag#Setting_it_as_a_custom_header] trick can be leveraged to configure setting of this flag differently for each environment and can be driven by application configuration.
 == ASP.NET ==
 <httpCookies requireSSL="true" />
-= Testing for the Secure Flag<br> =
+Verifying that a web site sets this flag on any particular cookie is easy. Using an intercepting proxy, like [[ZAP]], you can capture each response from the server and examine any Set-Cookie headers it includes to see if the HTTPOnly flag is set on the cookie.
-= Related Articles<br> =
+= Related Articles =
 [http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002) Testing for Cookie Attributes]<br>
 http://www.troyhunt.com/2011/11/owasp-top-10-for-net-developers-part-9.html

@@ Line 25: / Line 25: @@
     &lt;secure&gt;true&lt;/secure&gt;
    &lt;/cookie-config>
-  &lt;session-config&gt;
+  &lt;/session-config&gt;
 === Tomcat ===

@@ Line 35: / Line 35: @@
   String sessionid = request.getSession().getId();
   response.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; secure");
 === Environment consideration ===