4 ms·
you wouldn't get access to the cookie in most browsers. The github session cookie is apparently marked as httponly in which case JS wouldn't see it.
by pilif 16y ago
you wouldn't get access to the cookie in most browsers. The github session cookie is apparently marked as httponly in which case JS wouldn't see it.
- patio11 16y agoI wouldn't trust that, since there are many paths to the cheese besides document.cookie. For example, Firefox (IIRC) will let Javascript inspect all headers from an Ajax request. The cookie is just another string there...
- mike-cardwell 16y agoIs that actually possible, or are you just pondering that it might be? If Firefox lets you access the raw HTTP Cookie header of a http-only cookie via AJAX, I would consider that a security bug, and report it... I may take out 10 minutes to have a play with that later if nobody else checks first...
- patio11 16y agoI have personal knowledge that it was possible in 2007. I don't keep abreast of developments in browser security that make them more secure: unlike, say, Thomas and the geniuses at Matasano, all I need to know is the worst possible consequence of whatever our wonderful outsourcing partners dreamed up this time. XSS was one step below server-side code execution on our severity scale. [Edit: This was apparently fixed in 2009 in Firefox. http://www.mozilla.org/security/announce/2009/mfsa2009-05.html http://www.mozilla.org/security/announce/2009/mfsa2009-05.ht... Again, that is just one vector -- I still think HttpOnly is likely insufficient.]
- euroclydon 16y agoFrom our buddy Jeff: The big security hole, as alluded to above, is that Firefox (and presumably Opera) allow access to the headers through XMLHttpObject. So you could make a trivial JavaScript call back to the local server, get the headers out of the string, and then post that back to an external domain. Not as easy as document.cookie, but hardly a feat of software engineering. http://www.codinghorror.com/blog/2008/08/protecting-your-cookies-httponly.html http://www.codinghorror.com/blog/2008/08/protecting-your-coo...
- bl4k 16y agoSure you do. Easy to confirm, just fire up a console on github.com and enter document.cookie. What runs there can run on the page in injected code. Sess cookie for github is km_ai
- pilif 16y agoI would assume that the session cookie is _github_ses which is the only one that's set as both httponly and secure and, by the way, doesn't appear in document.cookie
- tptacek 16y agoTotally academic debate. HttpOnly is a band-aid; being able to inject Javascript still lets me do almost anything that I'd ever want to do with that cookie in the future.