CODEWITHSUNDEEP
securitycookiessslsession-cookies
BenM
BenM

Reputation: 4278

Cookie security when passed over SSL

Am I correct in thinking that if you pass a session cookie over an SSL encrypted request that the cookie could only be read by an attacker who had direct access to the computer that the cookie had been sent to, or the server it has been sent from, provided they are unable to crack the encryption?

Upvotes: 5

Views: 6817

Answers (3)

SilverlightFox
SilverlightFox

Reputation: 33538

To add to @John Wu's answer you can also protect against another type of MITM attack by setting the Secure Flag. This will make sure that the cookie is only transmitted by the browser when the request is sent encrypted over HTTPS.

Even though the cookie can only be set by your site, you should still encode if it is output to guard against XSS. See my other answer here for more details: https://security.stackexchange.com/a/44976/8340

Upvotes: 3

John Wu
John Wu

Reputation: 52250

SSL encrypts all traffic, including the header (which contains the cookie value).

On the other hand, the cookie can be accessed via Javascript on the client machine, unless you have marked it as HttpOnly. A hacker could potentially get this script to run via an XSS attack.

In addition, there are ways to hijack the cookie with a carefully crafted email or web page. This is known as session riding or CSRF.

Finally, cookies are visible on the wire for any network connection beyond the point of SSL termination, e.g. if you data center uses SSL offloading and/or deep packet inspection.

Oh, and one more thing. If SSL isn't configured correctly it is easily vulnerable to MITM attack, e.g. your server is configured to accept a null protocol. In this case a hacker can of course read the cookie plain as day.

I think that's it. That should be enough to keep you up at night.

Upvotes: 10

m.edmondson
m.edmondson

Reputation: 30892

Correct, SSL encrypts all HTTP on the wire.

Upvotes: 2

Related Questions