Launchpad session cookie is accessible from Javascript

[James Henstridge]

By default cookies are available to javascript running in the page. While this is not a problem in theory, if Launchpad had an cross site scripting hole it would expose our session credentials, which could then be passed to another site.

Apparently Internet Explorer 6 implements an extension to the Set-Cookie header that has been adopted for Firefox 3 that can help here:

    https://bugzilla.mozilla.org/show_bug.cgi?id=178993

So if we send the cookie as:
    Set-Cookie: launchpad=XXXXXX; domain=.launchpad.net; expires=...; secure; HttpOnly

Then it will be sent back to us as before, but will not be accessible to the page in document.cookies.

[James Henstridge (jamesh)]

It seems that the Python Cookie module (used by Zope for cookie handling) does not support custom attributes, such as HttpOnly.

[Stuart Bishop (stub)]

We might be better off fixing this in zope.session

[Stuart Bishop (stub)]

Make Launchpad use this when it is running with Python 2.6

[Guilherme Salgado (salgado)]

I thought we relied on this to access the webservice API using javascript.

[Stuart Bishop (stub)]

On Wed, Feb 17, 2010 at 5:54 PM, Guilherme Salgado <email address hidden> wrote:

> I thought we relied on this to access the webservice API using
> javascript.

I don't think so, but it certainly is something to test. As I understand it, the cookie will still be sent with all HTTP requests, including those initiated from JavaScript to launchpad.net. The JavaScript can't access the cookie itself though so cannot steal or do anything malicious with it.

--
Stuart Bishop <email address hidden>
http://www.stuartbishop.net/

[Francis J. Lacoste (flacoste)]

We rely on the session cookie being sent with the AJAX http requests. We don't need to access it through document.cookies. So this seems safe.

[David Wagner (daw-bugzilla)]

I wonder if you're aware that HttpOnly adds only very limited protections? If someone can run malicious script on your domain, then in most cases they can do just as much harm with HttpOnly cookies as without; it just requires a more complex attack. So this may "raise the bar" slightly, but doesn't add a lot of security; you're primarily relying upon avoiding XSS bugs in the first place.

Analysis and detailed justification:
http://www.gnucitizen.org/blog/why-httponly-wont-protect-you/

[Robert Collins (lifeless)]

@David this is a defense in depth approach, not a blanket win (obviously).

[Robert Collins (lifeless)]

We're on 2.6 now, so this can be done.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r14912 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/14912>.