3 ms·
This is a welcomed change as it prevents unrelated sites from making XHRs to unrelated sites (already mitigated by browser restrictions with allow credentials a
by mevile 10y ago
This is a welcomed change as it prevents unrelated sites from making XHRs to unrelated sites (already mitigated by browser restrictions with allow credentials and very loose Access-Control-Allow-Origin server headers) but I'd like to point out that if someone stole your cookies via a XSS request they could free themselves of browser restrictions by making requests by not using a browser.
This is particularly a problem for sites that have XSS vulnerabilities and don't use the http only property for sensitive cookies and non-https sites on open wifi networks. Sites should use a combination of secure (cookies transmitted over https only) and http only (JS can't access the cookie) cookies and redirect all http traffic to https. Ad networks need to get better at helping sites monetize on https only traffic, it's a huge barrier for many sites making the switch and helping the internet finally relegating plain text http traffic to the history books.
- readams 10y agoThis is much more about CSRF than XSS.
- elchief 10y agoIf you leave your windows open, your door lock isn't useful either.
- tshadwell 10y agoThe primary problem this hopes to solve is actually CSRF. Simply generating an HTML form for a website for any website and submitting it sends the cookies of the target website, regardless of where the form is based. XHR isn't so much of an issue as it has same origin policy restrictions. This spec allows you to set cookies that turn this outdated and age-old security policy on its head, so instead of having to generate and validate cryptographically derived client-correlated tokens on every form (CSRF tokens), we can simply set this flag and refuse to send these cookies from any other site. This has long been known to be the right thing to do, which is why other new-age web policies like CORS refuse to send cookies completely by default. The HttpOnly flag is meant to mitigate cookie theft risk via XSS. To my knowledge this particular innovation actually does nothing to that risk.
- sintaxi 10y agoYep, CSRF is a completely opt-in problem to have. There is pretty much zero (valid) reasons to need Cookies anymore. Although I agree this spec is an improvement. Its main purpose should be to make legacy systems more secure. The best course of action would be to avoid cookies entirely.
- tshadwell 10y agoWhat are you proposing to replace cookies with? Auth tokens and XHR? Localstorage? Why?