Cookies should be set as 'secure' over SSL

[rcubetrac]

Reported by mkj on 11 Sep 2008 15:57 UTC as Trac ticket #1485336

Even if a website is set up using SSL, an active attacker can steal cookies unless the cookies have been set 'secure' - see http://fscked.org/blog/fully-automated-active-https-cookie-hijacking

Roundcube doesn't set cookies as secure. It looks like the only place that needs changing is the second setcookie() in
session.inc

Something like

setcookie(session_name(), $random, $lifetime, $cookie[$cookie['domain']('path'],),  $_SERVER["HTTPS"]);

might be the way to go? (I haven't used PHP much so am guessing from the docs).

Migrated-From: http://trac.roundcube.net/ticket/1485336

[rcubetrac]

Milestone changed by @alecpl on 12 Sep 2008 06:03 UTC

later => 0.2-beta

[rcubetrac]

Comment by robin on 12 Sep 2008 06:48 UTC

Index: program/include/session.inc
===================================================================
--- program/include/session.inc (revision 1760)
+++ program/include/session.inc (working copy)
@@ -184,7 +184,8 @@
   $lifetime = $cookie[? time() + $cookie['lifetime']('lifetime']) : 0;

   setcookie(session_name(), '', time() - 3600);
-  setcookie(session_name(), $random, $lifetime, $cookie[$cookie['domain']('path'],));
+  setcookie(session_name(), $random, $lifetime, $cookie[$cookie['domain']('path'],),
+                       $_SERVER[&& ($_SERVER['HTTPS']('HTTPS'])!='off'));

   return true;
 }

I have no test-RC running over https so cannot test that. Over http this doesn't have any impact.

[rcubetrac]

Comment by mkj on 12 Sep 2008 17:32 UTC

I've tested that patch here (with roundcube 0.1.1 though) and it sets the logged-in sessionid cookie as secure, but doesn't set the initial pre-login session cookie as secure. I'm not sure if that really matters though? Does the pre-login session cookie get used for anything?

session_set_cookie_params() could be used to setup the initial cookie as secure I think.

[rcubetrac]

Comment by tensor on 15 Sep 2008 09:19 UTC

I guess the prelogin cookie should also be secured.

[rcubetrac]

Comment by robin on 18 Sep 2008 11:54 UTC

Pre-login does not need to be 'secured'. Session cookie security fixed in d0b973c.

[rcubetrac]

Status changed by robin on 18 Sep 2008 11:54 UTC

new => closed