Difference between revisions of "SecureFlag"

From OWASP
Jump to: navigation, search
m (Fixed bug in Java config)
Line 1: Line 1:
{{Stub}}
+
= Overview =
 
+
= Overview<br> =
+
  
 
The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP&nbsp;Response. The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a the cookie in clear text.<br>
 
The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP&nbsp;Response. The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a the cookie in clear text.<br>
Line 12: Line 10:
  
 
Following sections describes setting the Secure Flag in respective technologies.
 
Following sections describes setting the Secure Flag in respective technologies.
 
  
 
== Java ==
 
== Java ==
Line 39: Line 36:
  
 
With this flag always set, sessions won't work in environments(development/test/etc.) that may use http. SessionCookieConfig [http://java.sun.com/javaee/6/docs/api/javax/servlet/SessionCookieConfig.html#setSecure%28boolean%29] interface or setting custom header[https://www.owasp.org/index.php/SecureFlag#Setting_it_as_a_custom_header] trick can be leveraged to configure setting of this flag differently for each environment and can be driven by application configuration.  
 
With this flag always set, sessions won't work in environments(development/test/etc.) that may use http. SessionCookieConfig [http://java.sun.com/javaee/6/docs/api/javax/servlet/SessionCookieConfig.html#setSecure%28boolean%29] interface or setting custom header[https://www.owasp.org/index.php/SecureFlag#Setting_it_as_a_custom_header] trick can be leveraged to configure setting of this flag differently for each environment and can be driven by application configuration.  
 
  
 
== ASP.NET ==
 
== ASP.NET ==
  
 +
Set the following in Web.config:
 
<httpCookies requireSSL="true" />
 
<httpCookies requireSSL="true" />
  
 +
By default, the .NET session cookie has this flag set already.
  
 +
= Testing for the Secure Flag =
  
= Testing for the Secure Flag<br> =
+
Verifying that a web site sets this flag on any particular cookie is easy. Using an intercepting proxy, like [[ZAP]], you can capture each response from the server and examine any Set-Cookie headers it includes to see if the HTTPOnly flag is set on the cookie.
  
= Related Articles<br> =
+
= Related Articles =
  
 
[http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002) Testing for Cookie Attributes]<br>
 
[http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002) Testing for Cookie Attributes]<br>
 
http://www.troyhunt.com/2011/11/owasp-top-10-for-net-developers-part-9.html
 
http://www.troyhunt.com/2011/11/owasp-top-10-for-net-developers-part-9.html

Revision as of 10:39, 20 December 2013

Contents

Overview

The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a the cookie in clear text.

To accomplish this goal, browsers which support the secure flag will only send cookies with the secure flag when the request is going to a HTTPS page. Said in another way, the browser will not send a cookie with the secure flag set over an unencrypted HTTP request.

By setting the secure flag, the browser will prevent the transmission of a cookie over an unencrypted channel.

Setting the Secure Flag

Following sections describes setting the Secure Flag in respective technologies.

Java

Servlet 3.0 (Java EE 6)

Sun Java EE supports secure flag in Cookie interface since version 6 (Servlet class version 3)[1], also for session cookies (JSESSIONID)[2]. Methods setSecure and isSecure can be used to set and check for secure value in cookies.

web.xml

Servlet 3.0 (Java EE 6) introduced a standard way to configure secure attribute for the session cookie, this can be done by applying the following configuration in web.xml

<session-config>
 <cookie-config>
  <secure>true</secure>
 </cookie-config>
</session-config>

Tomcat

In Tomcat 6 if the first request for session is using https then it automatically sets secure attribute on session cookie.

Setting it as a custom header

For older versions the workaround is to rewrite JSESSIONID value using and setting it as a custom header. The drawback is that servers can be configured to use a different session identifier than JSESSIONID.

String sessionid = request.getSession().getId();
response.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; secure");

Environment consideration

With this flag always set, sessions won't work in environments(development/test/etc.) that may use http. SessionCookieConfig [3] interface or setting custom header[4] trick can be leveraged to configure setting of this flag differently for each environment and can be driven by application configuration.

ASP.NET

Set the following in Web.config: <httpCookies requireSSL="true" />

By default, the .NET session cookie has this flag set already.

Testing for the Secure Flag

Verifying that a web site sets this flag on any particular cookie is easy. Using an intercepting proxy, like ZAP, you can capture each response from the server and examine any Set-Cookie headers it includes to see if the HTTPOnly flag is set on the cookie.

Related Articles

Testing for Cookie Attributes
http://www.troyhunt.com/2011/11/owasp-top-10-for-net-developers-part-9.html