Bugzilla – Attachment 14384 Details for
Bug 9102
[SECURITY] We should set httponly on our session cookie
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED-OFF] Bug 9102 : Set HttpOnly on the CGISESSID cookie
SIGNED-OFF-Bug-9102--Set-HttpOnly-on-the-CGISESSID.patch (text/plain), 3.80 KB, created by
Katrin Fischer
on 2013-01-03 07:36:04 UTC
(
hide
)
Description:
[SIGNED-OFF] Bug 9102 : Set HttpOnly on the CGISESSID cookie
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2013-01-03 07:36:04 UTC
Size:
3.80 KB
patch
obsolete
>From 6089d9889b76957b3f5c0d858eaf733dec0f162c Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Sun, 18 Nov 2012 20:01:37 +1300 >Subject: [PATCH] [SIGNED-OFF] Bug 9102 : Set HttpOnly on the CGISESSID cookie > >https://www.owasp.org/index.php/HttpOnly > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> > >To test, use curl > >Before the patch > >% curl -I http://192.168.2.135 >HTTP/1.1 200 OK >Date: Sun, 18 Nov 2012 06:56:49 GMT >Server: Apache/2.2.22 (Ubuntu) >Pragma: no-cache >Cache-control: no-cache >Content-script-type: text/javascript >Content-style-type: text/css >Set-Cookie: CGISESSID=19689f6e7d8ec94c25269fecebf2f009; path=/ >Vary: Accept-Encoding >Content-Type: text/html; charset=UTF-8 > >After patch > > % curl -I http://192.168.2.135 >HTTP/1.1 200 OK >Date: Sun, 18 Nov 2012 07:01:04 GMT >Server: Apache/2.2.22 (Ubuntu) >Pragma: no-cache >Cache-control: no-cache >Content-script-type: text/javascript >Content-style-type: text/css >Set-Cookie: CGISESSID=da25baf03c0bc1e2c512a627028e43e6; path=/; HttpOnly >Vary: Accept-Encoding >Content-Type: text/html; charset=UTF-8 >--- > C4/Auth.pm | 32 +++++++++++++++++++++++--------- > 1 file changed, 23 insertions(+), 9 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index b32136a..2eb63f5 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -635,13 +635,15 @@ sub checkauth { > if ( $userid = $ENV{'REMOTE_USER'} ) { > # Using Basic Authentication, no cookies required > $cookie = $query->cookie( >- -name => 'CGISESSID', >- -value => '', >- -expires => '' >+ -name => 'CGISESSID', >+ -value => '', >+ -expires => '', >+ -HttpOnly => 1, > ); > $loggedin = 1; > } >- elsif ( $sessionID = $query->cookie("CGISESSID")) { # assignment, not comparison >+ elsif ( $sessionID = $query->cookie("CGISESSID") ) >+ { # assignment, not comparison > my $session = get_session($sessionID); > C4::Context->_new_userenv($sessionID); > my ($ip, $lasttime, $sessiontype); >@@ -707,8 +709,12 @@ sub checkauth { > $userid = undef; > } > else { >- $cookie = $query->cookie( CGISESSID => $session->id ); >- $session->param('lasttime',time()); >+ $cookie = $query->cookie( >+ -name => 'CGISESSID', >+ -value => $session->id, >+ -HttpOnly => 1 >+ ); >+ $session->param( 'lasttime', time() ); > unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... > $flags = haspermission($userid, $flagsrequired); > if ($flags) { >@@ -724,8 +730,12 @@ sub checkauth { > my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; > my $sessionID = $session->id; > C4::Context->_new_userenv($sessionID); >- $cookie = $query->cookie( CGISESSID => $sessionID ); >- $userid = $query->param('userid'); >+ $cookie = $query->cookie( >+ -name => 'CGISESSID', >+ -value => $session->id, >+ -HttpOnly => 1 >+ ); >+ $userid = $query->param('userid'); > if ( ( $cas && $query->param('ticket') ) > || $userid > || ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne >@@ -916,7 +926,11 @@ sub checkauth { > { > # successful login > unless ($cookie) { >- $cookie = $query->cookie( CGISESSID => '' ); >+ $cookie = $query->cookie( >+ -name => 'CGISESSID', >+ -value => '', >+ -HttpOnly => 1 >+ ); > } > return ( $userid, $cookie, $sessionID, $flags ); > } >-- >1.7.9.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9102
:
13504
|
13539
|
13580
|
13838
|
14384
|
14618
|
14994