{"id":16,"date":"2007-01-30T02:46:14","date_gmt":"2007-01-30T02:46:14","guid":{"rendered":"http:\/\/robubu.com\/?p=16"},"modified":"2007-01-30T02:53:20","modified_gmt":"2007-01-30T02:53:20","slug":"httponly-please-more","status":"publish","type":"post","link":"https:\/\/robubu.com\/?p=16","title":{"rendered":"HttpOnly please – more"},"content":{"rendered":"

So my previous post<\/a> described some of the challenges involved in maintaining security in a site, such as a blogging site, that allows unrestricted \/ unfiltered user authored content and suggested "HttpOnly" cookies<\/a> could mitigate some of the risk . "HttpOnly" cookies are, however, not a complete solution.\u00c2\u00a0<\/p>\n

The remaining problem is described in one of the comments<\/a> in the mozilla "HttpOnly" bug posting. Here’s a concrete example. I log into my blog at http:\/\/blogs.com\/robyates. I then visit the blog http:\/\/blogs.com\/attacker\/. Let’s assume that I am using I.E. and that blogs.com uses "HttpOnly" cookies.\u00c2\u00a0 The javascript on the attacker’s blog can’t get access to my "HttpOnly" cookie’s, so it can’t steal my session, but it can open a hidden iframe and then use this iframe to make posts, add spam etc. etc.and given that I have an authenticated session it can do all this under my identity, pretty bad.\u00c2\u00a0 It can do this as the attackers blog and my blog are in the same domain i.e. http:\/\/blogs.com.<\/p>\n

Fortunately, this problem is well understood by the large public blogging organizations such as livejournal. Their approach<\/a> gives each user their own domain and this domain is separate from the management domain. So, for example, my blog could now be http:\/\/robyates.blogs.com, the attackers is http:\/\/attacker.blogs.com and my blog is managed at http:\/\/manage.blogs.com\/robyates.\u00c2\u00a0 Now due to cross frame scripting security<\/a> which also applies to XMLHttpRequests, the javascript on the attackers site is rendered useless. Any javascript running on the attacker.blogs.com domain can’t get access to the data on the robyates.blogs.com or manage.blogs.com domain, so my postings can’t be deleted and spam can’t be added.<\/p>\n

The key point here, when designing an application that permits user supplied html, is to segment the application into discrete security regions and assign each region a unique domain. This way any erroneous javascript is constrained to some subset of the complete application.<\/p>\n

So in combination with carefully constructed domain partitioning of the application "HttpOnly" cookies show real potential\u00c2\u00a0 With any luck we’ll see it show up in firefox real soon, as the bug<\/a> looks to be heading in the right direction.<\/p>\n

Finally, having recently learnt all about this so we can recommend topologies for our new blogging application<\/a>, it’s got me thinking about how secure any JSON<\/a> based api is, scary stuff!<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"

So my previous post described some of the challenges involved in maintaining security in a site, such as a blogging site, that allows unrestricted \/ unfiltered user authored content and suggested "HttpOnly" cookies could mitigate some of the risk . "HttpOnly" cookies are, however, not a complete solution.\u00c2\u00a0 The remaining problem is described in one … Continue reading “HttpOnly please – more”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[7],"tags":[],"class_list":["post-16","post","type-post","status-publish","format-standard","hentry","category-security"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/robubu.com\/index.php?rest_route=\/wp\/v2\/posts\/16","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/robubu.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/robubu.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/robubu.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/robubu.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16"}],"version-history":[{"count":0,"href":"https:\/\/robubu.com\/index.php?rest_route=\/wp\/v2\/posts\/16\/revisions"}],"wp:attachment":[{"href":"https:\/\/robubu.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/robubu.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/robubu.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}