Default behavior of UserAuthnMethod#create_cookie should be an HttpOnly cookie

[gobengo]

OWASP recommends that authn session cookies are HttpOnly unless otherwise needed.
https://www.owasp.org/index.php/HttpOnly

Do you think this is a good idea?

[rohe]

9 dec 2015 kl. 19:59 skrev Benjamin Goering notifications@github.com:

OWASP recommends that authn session cookies are HttpOnly unless otherwise needed.
https://www.owasp.org/index.php/HttpOnly

Do you think this is a good idea?

Sounds reasonable !
I’ll put in on the to-do list.

— Roland
'Look, that's why there's rules, understand? So that you think before you break ’em.’ - Terry Pratchett

[gobengo]

FWIW, I did this by adding the following to my UserAuthnMethod

import Cookie
def create_cookie(self, *args, **kwargs):
    """
    Like super().create_cookie, but adds HttpOnly
    https://www.owasp.org/index.php/HttpOnly
    """
    header, value = \
        super(PasswordAuthnModule, self).create_cookie(*args, **kwargs)
    cookie = Cookie.SimpleCookie(value)
    cookie[self.srv.cookie_name]['httponly'] = True
    http_only_value = str(cookie)
    return (header, http_only_value)

[tpazderka]

This has been already done on master.