Sunday, June 3, 2012

HttpOnly Session ID in URL and Page Body | Cross Site Scripting

The Background

We have been seeing authentication session ID appeared in URL Query String/REST URI and page body.  The use of session ID in Query String is to enable session tracking for web browsers which disable or do not support browser-based cookie mechanism.  This is commonly seen in Java web applications and cookieless mechanism in ASP.net web applications.

From what we have seen so far, the session ID in page body is used as anti Cross Site Request Forgery token or anti-cache parameter though it is not very common.

The Problem

It should be noted that even though developers use the "HttpOnly" session cookie,  the above-mentioned  leakages of session ID in URL and page body nullify the effectiveness of "HttpOnly" flag.  This no doubt leads attackers to gain access to the HttpOnly session cookie via an Cross Site Scripting (XSS) vulnerability as JavaScript can read anything in the page body and URL information.



No comments:

Post a Comment