Re:Web Storage: the lesser evil for session tokens
by eganist on Tuesday May 31, 2016 @04:41PM
(#11810040)
> I don't know anybody who works full-time in software security who thinks HttpOnly is a meaningful defense, but, if you're out there, chime in and make a case for it. :)
I'd say a case can be made for it with certain very specific preconditions, with the most obvious being for applications where session tokens persist for convenience, perhaps inordinately so. I agree that at least within that browsing instance, you're dead in the water, but it would still be worse if an attacker gains persistent session access on platforms which handle re-authentication in a manner similar to this: https://github.com/reddit/reddit/blob/1619fe1cc138aad3d9c6bc...
(I got credited[1] for that gem two and a half years ago. It looks like the faulty logic is technically still there[2], but I haven't checked at all to see if they've mitigated it further. Their partial mitigation after my constant harassment was to actually implement site-wide HTTPS/HSTS and implement session token blacklisting since their session management logic needs much more work, but I can't find the latter feature in production anymore.)
I'd say a case can be made for it with certain very specific preconditions, with the most obvious being for applications where session tokens persist for convenience, perhaps inordinately so. I agree that at least within that browsing instance, you're dead in the water, but it would still be worse if an attacker gains persistent session access on platforms which handle re-authentication in a manner similar to this: https://github.com/reddit/reddit/blob/1619fe1cc138aad3d9c6bc...
(I got credited[1] for that gem two and a half years ago. It looks like the faulty logic is technically still there[2], but I haven't checked at all to see if they've mitigated it further. Their partial mitigation after my constant harassment was to actually implement site-wide HTTPS/HSTS and implement session token blacklisting since their session management logic needs much more work, but I can't find the latter feature in production anymore.)
---
[1] http://www.reddit.com/u/eganist
[2] https://github.com/reddit/reddit/blob/862a7e0fc5142058a88044...