cookies: leave secure cookies alone (draft-ietf-httpbis-cookie-alone-01)

[danielgustafsson]

Only allow secure origins to be able to write cookies with the 'secure' flag set. This reduces the risk of non-secure origins to influence the state of secure origins. This implements IETF Internet-Draft draft-ietf-httpbis-cookie-alone-01 which updates RFC6265.

This is an old patch I dusted off which I wouldn't mind eyes on. There needs to be tests added of course which is on my TODO. 

Update: this used to be marked WIP as it lacked the required tests. These have now been added and the PR title is updated to reflect this.

[bagder]

But yes, a test case that also verifies that it works as intended would be really good!

[danielgustafsson]

Do you think this should be added to an existing test, or should a new test be added?

[bagder]

I'm fine with either way. Whatever you find easiest.

[danielgustafsson]

Rebased, test added and bugs fixed

[danielgustafsson]

The Appveyor redness comes from 1506 failing which I believe is unrelated

[danielgustafsson]

Regarding the replacement policy for when a non-secure cookie is allowed to replace a secure cookie, the document states this for path comparisons:

Note: The "path" comparison is not symmetric, ensuring only
that a newly-created non-secure cookie does not overlay an
existing secure cookie, providing some mitigation against
cookie fixing attacks. That is, given an existing secure
cookie named "a" with a "path" of "/login", a non-secure
cookie named "a" could be set for a "path" of "/" or "/foo",
but not for a "path" of "/login" or "/login/en".

This leaves some room for implementation details IMHO. I have interpreted it in the most conservative way. The code implementing this could definitely need a set of eyes to ensure it's sane.

[danielgustafsson]

The reason for these large sections removed is that they are setting secure cookies over HTTP, which with this patch is no longer allowed.

[danielgustafsson]

As a reminder to myself for when the window opens: this patch also needs to remove item 5.8 from the TODO list. Will add that before this is pushed.