HttpOnly cookies in the Servlet 3.0 Specification
Saturday, May 30, 2009 at 04:11AM If a web application is voulnerable to XSS attacks, your cookies can easily get in the wrong hands. One of the more popular targets for XSS attracks is of course your session cookie. In wrong hands this cookie can enable an attacker to impersonate you, get access to persoal information or even your bank account.
Back in 2002 Microsoft implemented a mechanism called "HttpOnly Cookies" in their Internet Explorer 6 SP1". There is no magic involved; just an extra flag in the Set-Cookie response header. If the browser implements this, an attempt to read the cookie from a client side script will return an empty string.
Nowdays most servers and clients protects the session cookie this way; even though Ajax and the XMLHttpRequest object is lurking in the shadows. A snake in paradise but also a different story!
A new thing in the upcoming Servlet 3.0 specification is the support for HttpOnly custom cookies.
The servlet sends cookies to the browser by using the HttpServletResponse.addCookie(javax.servlet.http.Cookie) method, which adds fields to HTTP response headers to send cookies to the browser, one at a time. The browser is expected to support 20 cookies for each Web server, 300 cookies total, and may limit cookie size to 4 KB each.
In the new servlet specfication, the Cookie class has the following methods;
void setHttpOnly(boolean isHttpOnly)
boolean isHttpOnly()
Great news for security aware web developers!
Reader Comments