Userdir URLs like https://example.org/~username/ are dangerous

Re:Userdir URLs like https://example.org/~username/ are dang... by justinsteven on Tuesday April 07, 2020 @10:53PM (#22809617)

It would not. It would stop the cookie from being sent to things outside of the path specified, but the Same Origin Policy is about, among other things, gaining read-access to the responses of fetch/XMLHttpRequest/AJAX requests.

If there is a cookie set for the path '/secret' and I can host content at '/attacker', then some of my JavaScript under /attacker could do a fetch request to /secret/something. This fetch request would carry the cookie for /secret, and the response would be readable by my JavaScript (due to Same Origin Policy). I could read the response, extract sensitive content, or even extract CSRF tokens to allow me to do state-changing CSRF-protected things under /secret

[ Parent | on HN ]

Re:Userdir URLs like https://example.org/~username/ are dang... by vbezhenar on Tuesday April 07, 2020 @11:22PM (#22809752)

What about setting Cookie with Path and SameSite=LAX? I would expect it to prevent sending cookies in that request, although I did not test it.

[ Parent | on HN ]

Re:Userdir URLs like https://example.org/~username/ are dang... by justinsteven on Wednesday April 08, 2020 @12:17AM (#22810020)

I tested with SameSite being Lax and Strict. Neither block the attack in Chrome. My reading of the SameSite spec indicates that it doesn't take cookie path into account.

[ Parent | on HN ]