[HN Gopher] JavaScript can overwrite or remove HTTPONLY cookies
       ___________________________________________________________________
        
       JavaScript can overwrite or remove HTTPONLY cookies
        
       Author : EGreg
       Score  : 19 points
       Date   : 2023-07-24 20:16 UTC (2 hours ago)
        
 (HTM) web link (www.sjoerdlangkemper.nl)
 (TXT) w3m dump (www.sjoerdlangkemper.nl)
        
       | chromoblob wrote:
       | Seems like a bug in browsers.
        
         | TechBro8615 wrote:
         | Agreed, although I'd classify it as a design flaw more than a
         | bug. I think the correct design of the overwrite behavior would
         | be to only evict cookies of the same HttpOnly value when a new
         | cookie is set that causes the number to overflow. If that's not
         | possible, then it should throw an error.
        
           | EGreg wrote:
           | My cofounder wrote about how httponly cookies are pure
           | security theater, a decade ago:
           | https://news.ycombinator.com/item?id=12141611
        
             | Sohcahtoa82 wrote:
             | Yup, this is something that is frequently not talked about.
             | 
             | HttpOnly merely prevents the theft of the cookie via XSS.
             | It doesn't prevent an attacker from performing operations
             | on behalf of the user via XSS.
             | 
             | That said, it _does_ make the attack _slightly_ harder. You
             | have to write a bespoke attack script, rather than just a
             | nearly universal one-liner to steal the cookie and then
             | take over from there. In addition, if the victim navigates
             | away from the page, then the attack ends. Of course, most
             | likely, the attack script will only need a few seconds at
             | most to complete the attack script.
        
       | EGreg wrote:
       | Also notice that you in most implementations where clients can
       | choose their own value for sessionId, malicious injected scripts
       | can use a _session fixation attack_ to then exfiltrate your info.
       | 
       | They don't need to craft a special link, as long as they inject a
       | script into your site it's game over.
       | 
       | That's why your server should _sign_ session IDs it generates
       | with an HMAC and reject any ones that the client simply sets! The
       | client can overwrite httponly but it will only log the user out
       | and annoy them.
        
       ___________________________________________________________________
       (page generated 2023-07-24 23:02 UTC)