Permanent Cookie Contains Sensitive Session Information

[Adam Heczko]

Observed on:
All Horizon implementations using Django versions prior to 1.7

Problem description:
Http session cookie (Horizon cookie) containing CSRF token is stored on disk for a long period of time.
This makes possible to perform CSRF attack on Horizon when cookie gets revealed/stolen from disk.

Upstream bug report:
https://bugs.launchpad.net/horizon/+bug/1369865

Solution proposal:
- ensure that we ship MOS with appropriate Django version >=1.7
- patch Django shipped with MOS if older version is used
- apply other CSRF preventive actions:
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#CSRF_Prevention_without_a_Synchronizer_Token
https://benjaminhorn.io/code/setting-cors-cross-origin-resource-sharing-on-apache-with-correct-response-headers-allowing-everything-through/

[Vitaly Sedelnik (vsedelnik)]

Won't Fix for 7.0-updates because of Medium importance

[Timur Sufiev (tsufiev-x)]

In release 8.0 django 1.7 is used for Ubuntu, CentOS has django 1.8. So the bug is not relevant for 8.0.

[Adam Heczko (aheczko-mirantis)]

I'd suggest to backport one line fix described here:
https://review.openstack.org/#/c/246611/

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-8.0/liberty
Change author: Kent Wang <email address hidden>
Review: https://review.fuel-infra.org/15475

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/15475
Submitter: Pkgs Jenkins <email address hidden>
Branch: openstack-ci/fuel-8.0/liberty

Commit: 35adc081075bc32c8f590c62060798af25cd11f8
Author: Kent Wang <email address hidden>
Date: Wed Dec 23 11:31:21 2015

Change Permanent Cookie Contain Sensitive Info

Right now, the 'csrftoken' cookie is stored on disk as a permanent
cookie. There is a risk for sensitive session information (cookies)
that are persisted on disk as permanent cookies.

This fixes this issue by storing the cookies in-memory instead of
in persistent storage.

Change-Id: Ia45b09571d495d4f98b60545903af72eb0f061c2
Closes-Bug: #1522850

[Alexander Petrov (apetrov-n)]

This issue was verified under Firefox browser for MOS 8.0 RC1

Steps to reproduce:
1. Login in horizon to <host>
2. cd ~/.mozilla/firefox/<profile>
3. sqlite3 cookies.sqlite
4. select * from moz_cookies where baseDomain like '<host>';
5. make sure that the record with name 'csrftoken' doesn't exist