httpOnly Cookies in Firefox 2.0

Tuesday, October 24. 2006

httpOnly cookies are a Microsoft extension to the cookie standard. The idea is that cookies marked as httpOnly cannot be accessed from JavaScript. This was implemented to stop cookie stealing through XSS vulnerabilities. This is unlike many people believe not a way to stop XSS vulnerabilities, but a way to stop one of the possible attacks (cookie stealing) that are possible through XSS.

Unfortunately the mozilla family still refuses to implement httpOnly cookies in Firefox and therefore their newest release: Firefox 2.0 still comes without support for httpOnly cookies. Luckily an annoying bug within the Firefox internals was fixed in Firefox 2.0 which enables an extension to correctly intercept incoming and outgoing cookies. In previous Firefox versions it was not possible to intercept incoming cookies, because the Cookie header was already parsed before the examine response hook was called.

Therefore I sat down during the last hours and wrote my little httpOnly extension. This extension adds transparent httpOnly cookie support to Firefox by using a funny hack.

The idea of the extension is to create a random key in the Firefox preferences on the first startup. It then hooks the hooks for outgoing and incoming HTTP requests. It then parses all incoming cookies (for now only Set-Cookie header) and rewrites cookies marked as httpOnly. Their name gets a 'hO_' prefix and their content gets AES encrypted. The key used for this encryption is based on the key stored in the preferences and the real name of the cookie. This results in Firefox storing an encrypted cookie into it's cookie storage. Of course it is still possible for JavaScript to read this cookie, but because the content is encrypted it is not possible for malicious JavaScript to retrieve the original value. All outgoing cookies on the other hand will be processed by another hook and decrypted if they are 'hO_' prefixed.

With this little hack it is now possible to have httpOnly cookies in Firefox 2.0. You can download this little extension from here. Be warned that this was a hack of only a few hours. Therefore you should only consider it a proof of concept. However I am planning on improving it in the near future.

Update: I just uploaded the extension to addons.mozilla.org.

Posted by Stefan Esser in Security, PHP at 15:52

Comments (21)

Link to this post

Comments

Display comments as (Linear | Threaded)

#1 Chris ()

What about this scenario- a non-httpOnly cookie whose name happens to start with hO_ is sent to the browser.

Okay, it is not encrypted inbound because it is not httpOnly.

But what then happens outbound? Will the outbound hook try to decrypt it just because it's name begins with hO_?

What will that do to the cookie data?

posted on Wednesday, October 25. 2006

#1.1 Stefan Esser wrote (Link) ()

Chris,

the extension is only a proof of concept at the moment. Therefore unlikely scenarios like the above are not handled yet.

In the unlikely case that a cookie startes with hO_ it will not work correctly, unless it is marked as httpOnly. Normal cookie with that name would get registered and trash is sent back to the user. (If not an exception inside the JavaScript occurs...) In that case the Cookie header would get send still encrypted.

In future versions 'h0_' will be a configureable string and there will be a protection against this kind of scenario. (f.e. the Name could also be encrypted and only if the decryption works correctly it is assumed as encrypted)

There are other cases like an already existing cookie with the same name or JavaScript trying to set a h0_ cookie that are also not yet covered. But opensource is release early, release often.

The whole purpose of this extension is to get a high enough download counter to finally convinve the guys at mozilla.org implement this feature into the main browser code...

posted on Wednesday, October 25. 2006

#2 Cristian Rodriguez wrote (Link) ()

great work Stefan

Im running it now and testing it against the upcoming PHP 5.2.0 httponly cookie support..

posted on Wednesday, October 25. 2006

#3 Rickard Andersson wrote (Link) ()

Very nice! I don't know why the Mozilla people refuse to include support for this in Firefox. I posted this to digg.com as I think it needs as much attention as possible:

http://digg.com/security/The_FF2_extension_everyone_should_be_using

posted on Saturday, October 28. 2006

#4 Charles Darke wrote (Link) ()

I was looking to recompile FF to add in the HttpOnly patch released a while back when I found this plug-in.

However, I'm having a few problems with it. The main one being that it seems to find and encrypt the HttpOnly cookies OK, but these are not being returned even in PHP scripts.

Looking at the cookies, I noticed that a double quote mark is added and wonder if this is some sort of bug? For example, the cookie with name:

userid

now becomes:

"hO_userid

On a security issue side, one script I tested logs you out by overwriting the log-in cookies. When I installed the extension, the 'overwriting' created new (encrypted) cookies with the "hO_ name but didn't remove the old cookie. Again, possible due to a bug in the cookie re-naming.