I have a session token that's stored in a browser cookie client side. The cookie is already available for scripting and it's used to validate XHR through Javascript. For a particular page I'm using an iFrame to upload data to the server. Would there be any issues, beyond what I'm already exposed to, by including the session token as a hidden field in my iFrame?
1 Answer
This is a bad design. You should be setting the HTTPOnly flag on your cookies because it makes xss more difficult to exploit (but not impossible). If you write the cookie value to the page, then it undermines the protection provided by this flag.
Why are you including the cookie value in a variable with each request? The point of a cookie is that it occupies the Cookie: http header element of every request... which is redundant. It doesn't matter where the request originates from, the browser keeps track of the cookie. This is one of the reasons why CSRF is a problem.
Read the CSRF prevention cheat sheet and use one of these methods to protect your requests.
