Everything

php

Home » Project » Newsgroups » php.internals » HTTP-Only Patch »

HTTP-Only Patch

php.internals

Scott MacVicar

20 years ago

Hi,

After we recently experienced an XSS through what can only be described
as IE's shocking attempt at determining the mime type from the data and
ignoring what the server sent we decided to look into implementing
HTTP-only cookies. We know it's not a solution for preventing XSS, but
adding this would complicate the process for those wanting to exploit
any discovered problems before they are rectified.

HTTP-only is a feature in IE 6 SP1, Opera, Safari and KDE to allow the
setting of cookies that will only be sent via HTTP headers and never
accessible via client side scripting.

Ref: http://msdn.microsoft.com/workshop/author/dhtml/httponly_cookies.asp

I’ve added the flags for setcookie and setrawcookie. There is also
support for the session system as well included.

The attached patches are for PHP 5.2 and HEAD.

Regards,
Scott

Ilia A.

20 years ago

Seems like a good idea to me. If no one objects I'll apply this
patch, thanks Scott.

Ilia Alshanetsky

Brian Moon

20 years ago

Scott MacVicar wrote:

> Hi,
>
> After we recently experienced an XSS through what can only be described
> as IE's shocking attempt at determining the mime type from the data and
> ignoring what the server sent we decided to look into implementing
> HTTP-only cookies. We know it's not a solution for preventing XSS, but
> adding this would complicate the process for those wanting to exploit
> any discovered problems before they are rectified.
>
> HTTP-only is a feature in IE 6 SP1, Opera, Safari and KDE to allow the
> setting of cookies that will only be sent via HTTP headers and never
> accessible via client side scripting.
>
> Ref: http://msdn.microsoft.com/workshop/author/dhtml/httponly_cookies.asp
>
> I’ve added the flags for setcookie and setrawcookie. There is also
> support for the session system as well included.

+1

--

Brian Moon
-------------
http://dealnews.com/
Its good to be cheap =)

Richard Lynch

20 years ago

On Mon, August 7, 2006 9:53 am, Scott MacVicar wrote:

> After we recently experienced an XSS through what can only be
> described
> as IE's shocking attempt at determining the mime type from the data
> and
> ignoring what the server sent

In case anybody finds this in a Google search, I have found that this
IE stupidity or ignoring headers can be worked-around at an
application level by:
A) Forcing the URL to end in the .xyz extension Windows is configured
to believe is the given type of document (eg .pdf for PDF)
B) Putting the content-type/charset in a META tag within an HTML
document [1]

[1] This one really only applies to charset -- apparently, Microsoft
believes web Designers are smarter than web Developers about
content-type... :-v

--
Like Music?
http://l-i-e.com/artists.htm

steve roussey

20 years ago

Just a note -- having implemented and deployed this (in userspace, not
in php itself) -- setting the http_only flag kills the cookie in IE on
the Mac. One would hope no one is using such a thing anymore, but I
thought I'd point it out, and I'm definately in favor of the change.
Maybe it will get Mozilla to finally implement it (and deal with a
coookie file format change -- ooh, biggie).

Ilia A.

20 years ago

Scott,

Thanks for the patch, it is now part of the 5.2 tree.

Ilia