You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.qhelp
+23-14Lines changed: 23 additions & 14 deletions
Original file line number
Diff line number
Diff line change
@@ -4,48 +4,57 @@
4
4
<qhelp>
5
5
6
6
<overview>
7
-
<p>
8
-
Cookies without <code>HttpOnly</code> flag are accessible to JavaScript running in the same origin. In case of
9
-
Cross-Site Scripting (XSS) vulnerability the cookie can be stolen by malicious script.
10
-
</p>
7
+
<p>Cookies without the <code>HttpOnly</code> flag set are accessible to client-side scripts such as JavaScript running in the same origin.
8
+
In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script.
9
+
If a sensitive cookie does not need to be accessed directly by client-side JS, the <code>HttpOnly</code> flag should be set.</p>
11
10
</overview>
12
11
13
12
<recommendation>
14
13
<p>
15
-
Protect sensitive cookies, such as related to authentication, by setting <code>HttpOnly</code> to <code>true</code> to make
16
-
them not accessible to JavaScript. In ASP.NET case it is also possible to set the attribute via <code><httpCookies></code> element
17
-
of <code>web.config</code> with the attribute <code>httpOnlyCookies="true"</code>.
14
+
Set the <code>HttpOnly</code> flag to <code>true</code> for authentication cookies to ensure they are not accessible to client-side scripts.
15
+
</p>
16
+
<p>
17
+
When using ASP.NET Core, <code>CookiePolicyOptions</code> can be used to set a default policy for cookies.
18
+
19
+
When using ASP.NET Web Forms, a default may also be configured in the <code>Web.config</code> file, using the <code>httpOnlyCookies</code> attribute of the
20
+
the <code><httpCookies></code> element.
18
21
</p>
19
22
</recommendation>
20
23
21
24
<example>
22
25
23
26
<p>
24
-
In the example below <code>Microsoft.AspNetCore.Http.CookieOptions.HttpOnly</code> is set to <code>true</code>.
27
+
In the example below, <code>Microsoft.AspNetCore.Http.CookieOptions.HttpOnly</code> is set to <code>true</code>.
25
28
</p>
26
29
27
30
<samplesrc="httponlyflagcore.cs" />
28
31
29
32
<p>
30
-
In the following example <code>CookiePolicyOptions</code> are set programmatically to configure defaults.
33
+
In the following example, <code>CookiePolicyOptions</code> are set programmatically to configure defaults.
31
34
</p>
32
35
33
36
<samplesrc="cookiepolicyoptions.cs" />
34
37
35
38
<p>
36
-
In the example below <code>System.Web.HttpCookie.HttpOnly</code> is set to <code>true</code>.
39
+
In the example below, <code>System.Web.HttpCookie.HttpOnly</code> is set to <code>true</code>.
37
40
</p>
38
41
39
42
<samplesrc="httponlyflag.cs" />
40
43
44
+
<p>
45
+
In the example below, the <code>httpOnlyCookies</code> attribute is set to <code>true</code> in the <code>Web.config</code> file.
<li>Web Forms docs: <ahref="https://msdn.microsoft.com/en-us/library/system.web.httpcookie.httponly(v=vs.110).aspx">HttpCookie.HttpOnly Property</a>.</li>
56
+
<li>Web Forms docs: <ahref="https://msdn.microsoft.com/library/ms228262%28v=vs.100%29.aspx">httpCookies Element</a>.</li>
57
+
<li>PortSwigger: <ahref="https://portswigger.net/kb/issues/00500600_cookie-without-httponly-flag-set">Cookie without HttpOnly flag set</a></li>
Copy file name to clipboardExpand all lines: csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.qhelp
+21-15Lines changed: 21 additions & 15 deletions
Original file line number
Diff line number
Diff line change
@@ -4,33 +4,32 @@
4
4
<qhelp>
5
5
6
6
<overview>
7
-
<p>
8
-
Sensitive data that is transmitted using HTTP is vulnerable to being read by a third party. By default,
9
-
cookies are sent via HTTP, not HTTPS.
10
-
</p>
7
+
<p>Cookies without the <code>Secure</code> flag set may be transmitted using HTTP instead of HTTPS.
8
+
This leaves them vulnerable to being read by a third party attacker. If a sensitive cookie such as a session
9
+
key is intercepted this way, it would allow the attacker to perform actions on a user's behalf.</p>
11
10
</overview>
12
11
13
12
<recommendation>
14
13
<p>
15
-
In ASP.NET case when using cookies ensure that HTTPS is used by setting the property <code>Microsoft.AspNetCore.Http.CookieOptions.Secure</code> to <code>true</code>.
14
+
When using ASP.NET Core, ensure cookies have the secure flag set by setting <code>Microsoft.AspNetCore.Http.CookieOptions.Secure</code> to <code>true</code>, or
15
+
using <code>CookiePolicyOptions</code> to set a default security policy.
16
16
</p>
17
17
<p>
18
-
In ASP.NET Core case when using cookies, ensure that HTTPS is used, either via the <code><forms></code> attribute above, or
19
-
the <code><httpCookies></code> element, with the attribute <code>requireSSL="true"</code>. It is also possible to require cookies
20
-
to use HTTPS programmatically, by setting the property <code>System.Web.HttpCookie.Secure</code> to <code>true</code>.
18
+
When using ASP.NET Web Forms, cookies can be configured as secure by default in the <code>Web.config</code> file, setting the <code>requireSSL</code> attribute to <code>true</code> in the <code>forms</code> or <code>httpCookies</code> element.
19
+
Cookies may also be set to be secure programmatically by setting the <code>System.Web.HttpCookie.Secure</code> attribute to <code>true</code>.
21
20
</p>
22
21
</recommendation>
23
22
24
23
<example>
25
24
26
25
<p>
27
-
In the example below <code>Microsoft.AspNetCore.Http.CookieOptions.Secure</code> is set to <code>true</code> programmatically.
26
+
In the example below, <code>Microsoft.AspNetCore.Http.CookieOptions.Secure</code> is set to <code>true</code>.
28
27
</p>
29
28
30
29
<samplesrc="secureflagcore.cs" />
31
30
32
31
<p>
33
-
In the following example <code>CookiePolicyOptions</code> are set programmatically to configure defaults.
32
+
In the following example, <code>CookiePolicyOptions</code> are set programmatically to configure defaults.
34
33
</p>
35
34
36
35
<samplesrc="cookiepolicyoptions.cs" />
@@ -41,15 +40,22 @@ In the example below <code>System.Web.HttpCookie.Secure</code> is set to <code>t
41
40
42
41
<samplesrc="secureflag.cs" />
43
42
43
+
<p>
44
+
In the example below, the <code>requireSSL</code> attribute is set to <code>true</code> in the <code>forms</code> element of the <code>Web.config</code> file.
<li>Web Forms docs: <ahref="https://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.requiressl(v=vs.110).aspx">FormsAuthentication.RequireSSL Property</a>.</li>
55
+
<li>Web Forms docs: <ahref="https://msdn.microsoft.com/en-us/library/1d3t3c61(v=vs.100).aspx">forms Element for authentication</a>.</li>
56
+
<li>Web Forms docs: <ahref="https://msdn.microsoft.com/library/ms228262%28v=vs.100%29.aspx">httpCookies Element</a>.</li>
0 commit comments