4

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding.

There is a website, let’s say www.example.com which sets cookie at 2 stages.

  1. Connection between Load Balancer and Client -- LB_Cookie -- encrypted
  2. Connection between Client and Web Server -- ASP.NET_Session_Cookie -- encrypted & HttpOnly

In the above example, the ASP.NET_Session_Cookie is HttpOnly (secure from XSS attacks) - this is the cookie containing user’s session information. However, for LB_Cookie the HttpOnly flag is not set. I wonder if this could be an issue. Based on the information I obtained through resources on the internet - “all” cookies should be set to HttpOnly. However, they fail to explain what could go wrong if one of the cookies (Load Balancer cookie in my case) is not HttpOnly.

The purpose of LB_Cookie is such that the load balancer can remember, which web server it needs to send the incoming client requests to. There is no user specific data stored on this cookie. Is there anything wrong if it is not HttpOnly? I understand that it may be possible to steal LB_Cookie but even if this cookie is stolen, nothing much could go wrong because the attacker will not be able to take over user’s session. This is my understanding, and I am not able to imagine a scenario which could lead to trouble when LB_Cookie is not HttpOnly. Hence, I post these thoughts here for your opinion.

enter image description here

Improve this question

1 Answer 1

Reset to default
2

The HttpOnly flag only serves to protect sensitive cookies from scripts. Assuming the load balancing cookie is only concerned with routing through to a specific server and cannot identify a client, there's no harm in this cookie being exposed. A XSS attack will only identify which server the browser is connecting to, and not anything specific to the client that an attacker couldn't figure out anyways.

Improve this answer
4
  • If session state isn't shared among backend web servers and if the load balancer only uses the cookie for routing, changing the load balancer cookie would redirect the user to a different server effectively losing the session.
    – user2320464
    Commented Jun 25, 2015 at 15:29
  • @user2320464 Thinking about it, that could be part of an XSS exploit, but you'd need to also hijack the login process if you wanted to get a fresh session for your nefarious purposes, at which point I'd have to assume you have a lot more control than a simple XSS attack would generally get you.
    – phyrfox
    Commented Jun 25, 2015 at 15:36
  • @phyrfox, yes in this context the most likely avenue is XSS however it doesn't need to hook the login process. Invalidating the cookie at any time may send the user to a different server effectively losing the session.
    – user2320464
    Commented Jun 27, 2015 at 17:10
  • @user2320464 I do agree that it's a simple DoS style attack, but unless you can XSS every page on the site, it's mostly a one-shot attack that's mostly useless. Plus, there's a random chance the attack will fail, because the load balancer would randomly get them back to the right server.
    – phyrfox
    Commented Jun 27, 2015 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .