Cookie, Security, OWASP

-

We just had a Security Assessment for our web applications. Some points of interest follows:

Cookie

  1. XSS security: Where possible, all cookies should be configured to be httpOnly. This is to prevent client-side scripts or applets from accessing the cookie. Incidentally, this is the default for ASP.NET session cookie and cannot be changed via httpCookies element in Web.Config: <httpCookies httpOnlyCookies="true"/>
  2. Prevent MITM from accessing the session: Ensure that the session cookie is delivered over secured HTTP session (TLS). Setting the cookie as secured indicates to the browser that the cookie should only be sent over a secured channel. To configure the httpCookies element: <httpCookies requireSSL="true" />
  3. Note that Forms and Session cookies have slightly different behaviour with Forms cookie being more secured and more configurable.
    1. Interestingly, setting requireSSL to true for Forms cookie mandates that the communication channel to the web server be secured whereas Session cookie does not. This scenario applies in cases where the SSL terminates at the load balancers (LB) and the channel between the LB and the web server isn’t secured.
  4. GA sets several persistent cookies by default. The cookies are well examined here. Although the cookies appears to be issued from the same domain (1st party cookie), modifying the httpCookies element (httpOnlyCookies, requireSSL) does not appear to affect GA’s cookies.

IIS Server

  1. IIS is susceptible to HTTP 1.0 attacks whereby a HTTP 1.0 request without the host header would cause IIS to leak the IP address of the host.
  2. This issue has been discussed here.

Comments

Post a Comment

Popular posts from this blog

Understanding ITIL Service Management the UML way…

-
Image
I originally had a great deal of difficult reconciling the differences amongst ITIL Change Management, Incident Management, and Problem Management. Having researched on the subjects and understanding them better now, I’ve tried to put the concepts together using a UML class diagram to capture my understanding and to keep it imprinted. Similarly, I wanted to differentiate the various categories of changes (Standard, Emergency, Normal) using an easy to understand & self-explanatory manner – a UML Activity Diagram!
Read more

How to depict (Professional-Looking) Logical Network Diagrams in Astah

-
Image
I have always had to create (professional-looking) UML diagrams using Visio-like icons. You’ve got to admit that showing a bunch of boring UML boxes hardly interests anyone less technical (like anyone whose designation has the words “manager” or “director”). This is actually possible in Astah! I’ve created a template for future projects that allows me to produce logical network diagrams that look like the following: To create this diagram, you need to do the following: Assign various icons to stereotypes. I created the following for my use: Create a new UML Deployment Diagram Every element in the diagram is created as a Node The nodes are subsequently assigned the appropriate <<stereotype>>. E.g. Internet is <<internet>>, WebZone FW is <<firewall>>, Web LB is <<loadBalancer>> Ensure the “Icon Notation” is set to “Customized Icon” for each node Instead of the boring boxes, the corresponding icons automatically gets displayed!
Read more