2

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage also includes 3rd party hosted javascripts which are used for marketing and analytical purposes. Can any of those 3rd party javascripts read the http headers of the hosting http document?

Improve this question
5
  • Does the cookie use the HttpOnly flag?
    – rink.attendant.6
    Aug 17, 2015 at 6:15
  • Any script in your page, can read any cookie for your site that is not set for httponly (which means server-side readable only).
    – jfriend00
    Aug 17, 2015 at 6:25
  • Does it matter? are you suggesting the HtppOnly flag will prevent javascript includes from reader header information of the hosting html page
    – Sean Bradley
    Aug 17, 2015 at 6:26
  • 1
    Thanks for the HttpOnly info. It seems that this only goes so far though, since many of the few implementations of support for this in browsers and servers is that it is set to 'false' by default. Now I am beginning to understand why the EU is so paranoid about cookies.
    – Sean Bradley
    Aug 17, 2015 at 6:46
  • You might like to note the security mechanism for httponly seems to be described in a 2011 rfc.
    – munchkin
    Aug 17, 2015 at 8:27

2 Answers 2

Reset to default
1

As the commentators suggested you correctly, you will need to use the HttpOnly fla as a solution. But I just want to add a note regarding the right comments you received about HttpOnly flag.

In fact, if a client of your website uses a Mozilla Firefox browser of version before 3.0.6 (Bug 380418: XMLHttpRequest allows reading HTTPOnly cookies) and/or SeaMonkey browser of version before 1.1.15 (Rough Changelog for SeaMonkey 1.1.4) the HttpOnly won't be helpful because this flag won't be able to remove cookie information from the response headers in MLHttpObject.getAllResponseHeaders().

Further reading.

Improve this answer
0

It should also be noted that even though the scripts can't see your users' cookies (if using HttpOnly), they can still see the entire DOM (web page contents) and can submit requests on the user's behalf. The browser will automatically include the cookies with each request to your server, even though the script sending the request can't see the cookies. From the server's perspective, this is identical to the user taking the action themselves.

Including third party scripts is dangerous! Don't do it unless you sincerely trust the source of the script. Any third-party script you include on your page is, from a security standpoint, continuously in the position of having a successful XSS (Cross-Site Scripting) exploit on your users... and it's up to them what to do with it.

Even if the source of the script doesn't act maliciously, they can still wreck your site quite literally by accident if there's an error in the script or a server goes away or something. For example, consider that time Facebook broke the web because the script that puts their Like button on a page malfunctioned.

You can mitigate this risk somewhat by hosting scripts yourself, but sometimes that's not an option, or sometimes the script itself pulls in external resources.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .