[checkmk-commits] Check_MK Git: check_mk: #2391 SEC Auth cookie is using "secure" flag when HTTPS request detected

Module: check_mk Branch: master Commit: 46f0181efe57544c16f34c29d6d63ba40a7b024f URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=46f0181efe5754… Author: Lars Michelsen &lt;lm(a)mathias-kettner.de&gt; Date: Tue Jun 30 13:19:10 2015 +0200 #2391 SEC Auth cookie is using "secure" flag when HTTPS request detected In previous versions the authentication cookie, which identifies an authenticated user with the GUI, was never using the "secure" flag. This means the cookie was sent to the webserver when doing HTTP and HTTPS requests. In such a situation a user which authenticated using HTTPS could access the GUI using HTTP and was still authenticated becaus the browser sends the HTTPS related cookie via HTTP. This is some kind of security risk since the information which should only be transported using the encrypted HTTPS requests could be transported in clear text over the network using HTTP. The GUI tries now to detect the HTTPS requests. In case a HTTPS request is detected, the cookies are set with the "secure" flag which makes the cookies only used via HTTPS. The HTTPS detection currently checks wether or not the HTTP request header <tt>X-Forwarded-Proto</tt> is set to <tt>https</tt>. --- .werks/2391 | 25 +++++++++++++++++++++++++ ChangeLog | 1 + web/htdocs/html_mod_python.py | 5 ++++- 3 files changed, 30 insertions(+), 1 deletion(-) diff --git a/.werks/2391 b/.werks/2391 new file mode 100644 index 0000000..26f2bb2 --- /dev/null +++ b/.werks/2391 @@ -0,0 +1,25 @@ +Title: Auth cookie is using "secure" flag when HTTPS request detected +Level: 1 +Component: multisite +Class: security +Compatible: compat +State: unknown +Version: 1.2.7i3 +Date: 1435662820 + +In previous versions the authentication cookie, which identifies an +authenticated user with the GUI, was never using the "secure" flag. +This means the cookie was sent to the webserver when doing HTTP and +HTTPS requests. In such a situation a user which authenticated using +HTTPS could access the GUI using HTTP and was still authenticated +becaus the browser sends the HTTPS related cookie via HTTP. This is +some kind of security risk since the information which should only +be transported using the encrypted HTTPS requests could be transported +in clear text over the network using HTTP. + +The GUI tries now to detect the HTTPS requests. In case a HTTPS +request is detected, the cookies are set with the "secure" flag +which makes the cookies only used via HTTPS. + +The HTTPS detection currently checks wether or not the HTTP request +header <tt>X-Forwarded-Proto</tt> is set to <tt>https</tt>. diff --git a/ChangeLog b/ChangeLog index 272e4b6..ec63693 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,7 @@ * 2388 SEC: Fixed reflected XSS on the index page using the start_url parameter * 2389 SEC: Fixed XSS using the _body_class parameter of views... * 2390 SEC: Fixed possible XSS issue on views... + * 2391 SEC: Auth cookie is using "secure" flag when HTTPS request detected... * 2314 FIX: Availability: fixed exception when grouping by host or service group * 2361 FIX: Fix exception for missing key 'title' in certain cases of older customized views * 2379 FIX: Plugin-Output: Fixed handling of URLs within output of check_http... diff --git a/web/htdocs/html_mod_python.py b/web/htdocs/html_mod_python.py index 0d6a3f9..1c72e2f 100644 --- a/web/htdocs/html_mod_python.py +++ b/web/htdocs/html_mod_python.py @@ -66,8 +66,11 @@ class html_mod_python(htmllib.html): except: pass + def is_ssl_request(self): + return self.req.headers_in.get('X-Forwarded-Proto') == 'https' + def set_cookie(self, varname, value, expires = None): - c = Cookie.Cookie(varname, value, path = '/') + c = Cookie.Cookie(varname, value, path='/', secure=self.is_ssl_request()) if expires is not None: c.expires = expires