Issue metadata
Sign in to add a comment
|
Security: Some websites use cookies without SECURE and HTTPOnly attributes
Reported by
natnaelf...@gmail.com,
Nov 7 2017
|
||||||||||||||||||||||
Issue descriptionflags are missing in the cookie (1P_JAR,Secure),(NID, HttpOnly) Secure flag is not set on the cookie, the browser will send it over an unencrypted channel (plain HTTP) if such a request is made. Thus, the risk exists that an attacker might intercept the clear-text communication between the browser and the server and he will steal the cookie of the user. If this is a session cookie, the attacker could gain unauthorized access to the victim's web session. Lack of the HttpOnly flag permits the browser to access the cookie from client-side scripts (ex. JavaScript, VBScript, etc). This can be exploited by an attacker in conjuction with a Cross-Site Scripting (XSS) attack in order to steal the affected cookie. If this is a session cookie, the attacker could gain unauthorized access to the victim's web session.
,
Nov 8 2017
,
Nov 8 2017
Given mention of a cookie named "NID", it's possible that you're discussing a cookie sent by a Google website. Google websites use cookies as described here: https://www.google.com/policies/technologies/types/ Google teams are typically very well aware of the security properties of cookies and set the strictest security directives available to satisfy the use case for each cookie. With that said, if you believe you've found a cookie that leaks sensitive data over a non-secure channel, please feel free to report the bug via the process described here: https://sites.google.com/site/bughunteruniversity/ If you were attempting to report a problem with a non-Google website, please contact them directly.
,
Feb 15 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Nov 8 2017Labels: Needs-Feedback