Re: [WebDNA] Setting secure cookie
This WebDNA talk-list message is from 2009
It keeps the original formatting.
numero = 102500
interpreted = N
texte = Stuart Tremain wrote: > Donovan > > This cookie thing is becoming one of the standard security scans from > people such as McAfee Secure from https://www.mcafeesecure.com > > Description > The application sets a cookie over a secure channel without using the > "secure" attribute. RFC states that if the cookie does not have the > secure attribute assigned to it, then the cookie can be passed to the > server by the client over non-secure channels (http). Using this attack, > an attacker may be able to intercept this cookie, over the non-secure > channel, and use it for a session hijacking attack. > > General Solution > It is best business practice that any cookies that are sent (set-cookie) > over an SSL connection to explicitly state secure on them. yes, as I described ;-)... however, a highjacker should not be able to get into sensitive customer info regardless. As I said, there are *many* means to keep user info secure... which is the end goal here no matter what McAfee says. Encryption, Authentication, and cookie/orderfile strategy can all work together to keep things safe.. > Doing a redirect if not https - WebDNA does not detect https ! It doesn't have a push button solution.. no. > You noted in an earlier post (8 April 09) > "I don't know of many other WebDNA specific ways of finding this, so we > *will* make one! :-)" Yes I did. :-) > I look forward to BOTH additions !!! Me 2. Donovan -- Donovan Brooke WebDNA Software Corporation http://www.webdna.us **[Square Bracket Utopia]**
Associated Messages, from the most recent to the oldest:
Stuart Tremain wrote: > Donovan > > This cookie thing is becoming one of the standard security scans from > people such as McAfee Secure from https://www.mcafeesecure.com > > Description > The application sets a cookie over a secure channel without using the > "secure" attribute. RFC states that if the cookie does not have the > secure attribute assigned to it, then the cookie can be passed to the > server by the client over non-secure channels (http). Using this attack, > an attacker may be able to intercept this cookie, over the non-secure > channel, and use it for a session hijacking attack. > > General Solution > It is best business practice that any cookies that are sent (set-cookie) > over an SSL connection to explicitly state secure on them. yes, as I described ;-)... however, a highjacker should not be able to get into sensitive customer info regardless. As I said, there are *many* means to keep user info secure... which is the end goal here no matter what McAfee says. Encryption, Authentication, and cookie/orderfile strategy can all work together to keep things safe.. > Doing a redirect if not https - WebDNA does not detect https ! It doesn't have a push button solution.. no. > You noted in an earlier post (8 April 09) > "I don't know of many other WebDNA specific ways of finding this, so we > *will* make one! :-)" Yes I did. :-) > I look forward to BOTH additions !!! Me 2. Donovan -- Donovan Brooke WebDNA Software Corporation http://www.webdna.us **[Square Bracket Utopia]**
Donovan Brooke
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
Testing band width (2002)
Req for code: upload and append to DB (2002)
Printing a final order (1997)
[WebDNA] Amazon EC2 (2009)
WebCat2b13MacPlugIn - syntax to convert date (1997)
WebCat2 Append problem (B14Macacgi) (1997)
emailer w/F2 (1997)
Ok here is a question? (1997)
too many nested tags ... (1997)
A question about security (1998)
Where is f2? (1997)
Re:[ShowIf] and empty fields (1997)
[WebDNA] RETS Import (2010)
Forcing Search w/ URL (1999)
Encrypt/Decrypt (2007)
encrypt/decrypt (2001)
Price characteristics? (1997)
greater than or equal to (1997)
Make sure I understand this??? (1997)
Re1000001: Setting up shop (1997)