Could this XSS protection with HttpOnly Cookies work?
cookies, httponly, security, xmlhttprequest
Solution
Based on your post (title a bit misleading) I assume you understand that Httponly attribute prevents access to cookie via document.cookie and does nothing else to protect against the other nasty things that XSS allows including impersonating user (i.e., don't need to steal cookies and can use retrieved CSRF token), checking for vulnerable plugins on browser to install malware, installing javascript key logger, scanning your internal network, etc, rewriting the page, etc.
As you say whitelisting tags and attributes for each tag is not enough. You have to apply stricter validation on attribute values probably via whitelist regex.
An incomplete list of other things to consider a couple of which are not directly related to XSS or CSRF:
- How do you deal with incomplete html such as missing closing tags?
- How do you handle single quote, double quote, and backslash in user input?
- How do you handle user input that is output in different contexts - such as in url links, attribute values, etc.?
- Do you check that input actually matches input charset encoding?
- Do you explicitly set Content-Type in response header and in meta tag?
- For moderately sensitive user pages served over HTTP if any do you set appropriate Cache-Control header?
- How do you ensure user input is sandboxed? Specifically, if you allow CSS, how do you ensure style is applied only to restricted region and cannot alter other regions?
- Do you have 3rd party javascript including ads on the site?
- Is the session cookie protected against tampering if it should be?
- Do you sanitize all input including HTTP headers that can be modified by user?
- Is the CSRF token truly random - if yes, how do you generate random token? If not, how do you construct it?
- Do you use prepared statements and bind parameters?
- Can users upload files?
- Do you serve user uploaded content such as images, etc? If yes how do you validate file content (GIFAR flaw) and is the file served from same domain?
- Do you provide API access and if yes is it hosted on same domain? What crossdomain restriction do you have?
Problem
I have done some research on HttpOnly cookies and the problem that exist with the possibility to use an XHR request in combination with the TRACE method to get the cookie value echoed back from the server. For a secure webapplication I currently have the following setup: - Session cookie is sent at login with secure and httpOnly properties set - The TRACE http method is disabled for the complete domain (returning "405 Method not allowed") To avoid cross site request forgery I have added a random key in a hidden field to the forms. This key is must be returned in each POST request for the request to be accepted. Apart from this all HTML is escaped by default using whitelisting to select tags and attributes that are allowed, but to illustrate why this is not enough: We previously allowed the style-attribute on span to be used (to color text for example), which could be used to pass javascript in Internet Explorer in the following way: ``` <span style="width: expression(alert('Example'));"> </span> ``` And then to the final question: Could anybody point out any flaws or suggestions to possible flaws in this setup? Or are you using the same or completely different approaches? Known problems: - Not all browsers support httpOnly - Filtering css JS-expressions is not enough, @import(external-style-sheet) could also work