What are the security implications of allowing unlimited size cookies?

Question

Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size.

Are there any exploits involving large cookies?

i.e. How much more secure is restricting cookie size to 1024 rather than say 2048 characters.

What are the security implications of allowing unlimited (browser maximum) size cookies?

Answer 1

It seems likely that the restriction is more about disallowing something which seems likely to be malicious than a specific threat, however there are some potential risks I could think of with large cookies.

• Denial of Service. Assuming that the application processes the cookies, then a very large cookie value could cause the application to do excessive processing, leading to an app. DoS
• Attempt to exploit an overrun condition. If the application had some kind of buffer overrrun condition in cookie handling code then a large cookie could trigger that.

All that said the short answer is it depends on the application behind the WAF, and assuming it doesn't have flaws in coookie handling code, I don't see any particular reason to set a hard limit of 1024 chars for a cookie value.

Answer 2

One risk with large cookies is that they can be used to mount cookie jar overflow attacks. Some browsers have fixed limits on the amount of data they will store in the cookie jar. Thus, if an attacker tells your browser to remember a large cookie, this may cause some other cookies to be forgotten/deleted from the cookie jar. That can in turn allow some attacks.

Further details:

• Excerpt from the Browser Security Handbook:

  "Problems with cookie jar size: standards do relatively little to specify cookie count limits or pruning strategies. Various browsers may implement various total and per-domain caps, and the behavior may result in malicious content purposefully disrupting session management, or legitimate content doing so by accident."

• Racing to downgrade users to cookie-less authentication - describes how a malicious site can write enough cookies into the browser cookie jar to hit the limit, which then causes other sites to cookie-less modes of operation (which may be less secure).

• HTTP cookies, or how not to design protocols - describes attacks and weaknesses that arise as a result of how browsers prune the cookie jar when they are given too much cookie data. See especially the sections titled "8K ought to be enough for for anybody" and "Oh, please. Nobody is actually going to depend on them."

Answer 3

This is probably to prevent an HTTPOnly cookie disclosure exploit that affected Apache.