October 2008 - Dillo-dev - lists.mailman3.com

an experiment regarding cross site request forgery

by corvid＠lavabit.com

Johannes wrote: > On Wed, Oct 01, 2008 at 09:33:09PM +0000, corvid wrote: > > Justus wrote: > > > Johannes Hofmann wrote: > > > > Perhaps we should be more careful when to send out a cookie. > > > > What about not sending cookies with image requests, if the host of > > > > the image url is different from the one in the main page? > > > > What do other browser do about this? > > > > > > Yes, I think this is the way to go. One need to decide when to send out > > > authentication credentials (legitimate session) and when to strip them > > > (CSRF attempt). Martin Johns and I developed a firefox extension [0] > > > that does exactly this. Please see [1] pages 29 - 37 or [2] for more > > > information. [1] is also a pretty good introduction to CSRF. Please note > > > that the browser independent proxy solution is deprecated (but should > > > work unless the twisted framework changed its api too much) and the > > > firefox extension is somewhat unmaintained at the moment... > > > > Having done some reading now: > > So for an HTTP redirect or an image request, A->B, > > I gather up the cookies that I would send when asking for B > > and discard those that I would not send if I were asking for A? > > Sounds good. In which cases this will not discard all cookies? Well... if we had two johannes.de cookies and one had the Secure attribute, then if http://johannes.de redirected to https://johannes.de, we'd send one cookie, even though the server will probably expect both, and it's not an uncommon sort of redirect, so it might be bad. But at undergraduates.uni-johannes.de, I lean toward not wanting to trust the requester more than I am really forced to. For that matter, I think the rules let you make cookies for a domain as wide as .uni-johannes.de ..or .co.uk... I don't know. Maybe what cookies do is fundamentally a hard problem, but sometimes it feels like they were quickly hacked together without much concern for anything. Or perhaps the controlling bodies had ad revenue in mind more than anything else.

Oct. 3, 2008

feature freeze

by jcid＠dillo.org

On Thu, Oct 02, 2008 at 10:18:42PM +0100, Jeremy Henty wrote: > On Thu, Oct 02, 2008 at 08:01:58PM +0200, Johannes Hofmann wrote: > > > 6.- redraw storms related to the MenuTabPager (noticed by Jeremy) > > [...] > > 6: Using the ShrinkTabPager avoids the problem > > Here's a (tiny) patch to use the ShrinkTabPager. Committed as workaround for redraw storms. -- Cheers Jorge.-

Oct. 3, 2008

an experiment regarding cross site request forgery

by corvid＠lavabit.com

Justus wrote: > corvid wrote: > > Justus wrote: > >> Johannes Hofmann wrote: > >>> Perhaps we should be more careful when to send out a cookie. > >>> What about not sending cookies with image requests, if the host of > >>> the image url is different from the one in the main page? > >>> What do other browser do about this? > >> Yes, I think this is the way to go. One need to decide when to send out > >> authentication credentials (legitimate session) and when to strip them > >> (CSRF attempt). Martin Johns and I developed a firefox extension [0] > >> that does exactly this. Please see [1] pages 29 - 37 or [2] for more > >> information. [1] is also a pretty good introduction to CSRF. Please note > >> that the browser independent proxy solution is deprecated (but should > >> work unless the twisted framework changed its api too much) and the > >> firefox extension is somewhat unmaintained at the moment... > > > > Having done some reading now: > > So for an HTTP redirect or an image request, A->B, > > I gather up the cookies that I would send when asking for B > > and discard those that I would not send if I were asking for A? > I am not sure I understand your question. > > The basic csrf scenario is the following: > > 1. you log in to some web application hosted at good.org > 2. with the same browser instance using another window or tab (or you > just forget to log out and reused the same window) you visit evil.org > 3. evil.org hosts an html page that triggers an request to good.org, > either using an image/script/style/object/whatever tag in case of an GET > request or using an form and javascript / css to submit the form > 4. your browser sends any authentication credentials like cookies along > with the request since they are associated with the target host thus > allowing evil.org to change the state of your good.org account on your > behalf > > The proper thing to do is to fix this on the server side, but since csrf > isn't as widely known as xss many web applications are vulnerable to > this problem. I understand that there's a distinction between - dillo making the request on the user's behalf because he clicked a link or pressed a button or whatever, knowing the url. This request is made with the user's privileges. - dillo making the request on behalf of some code that caused a redirect or loaded an image (auth, css, javascript, etc. being implemented would result in further cases)... This request is sometimes made with some privileges depending on whether the requesting code has that privilege... So I want to be sure that I understand under what conditions the cookies can be sent. It seems that if the requesting url meets the conditions that would cause me to send it a cookie, then I either _did_ send it that cookie earlier, or it just gave it to me, so I would be (sort of) okay in sending that cookie in a request on its behalf. I see that rfc2965 also has some dot-based rules about "unverifiable transactions"... A bit of looking around the web gives me the impression that all of the various dot things that surround cookies have been an awful mess that don't map well to real-world trust boundaries. (This opera guy, for instance http://my.opera.com/yngve/blog/index.dml/tag/HTTP) Hmm...

Oct. 3, 2008

an experiment regarding cross site request forgery

by Johannes.Hofmann＠gmx.de

On Wed, Oct 01, 2008 at 09:33:09PM +0000, corvid wrote: > Justus wrote: > > Johannes Hofmann wrote: > > > Perhaps we should be more careful when to send out a cookie. > > > What about not sending cookies with image requests, if the host of > > > the image url is different from the one in the main page? > > > What do other browser do about this? > > > > Yes, I think this is the way to go. One need to decide when to send out > > authentication credentials (legitimate session) and when to strip them > > (CSRF attempt). Martin Johns and I developed a firefox extension [0] > > that does exactly this. Please see [1] pages 29 - 37 or [2] for more > > information. [1] is also a pretty good introduction to CSRF. Please note > > that the browser independent proxy solution is deprecated (but should > > work unless the twisted framework changed its api too much) and the > > firefox extension is somewhat unmaintained at the moment... > > Having done some reading now: > So for an HTTP redirect or an image request, A->B, > I gather up the cookies that I would send when asking for B > and discard those that I would not send if I were asking for A? Sounds good. In which cases this will not discard all cookies? Cheers, Johannes

Oct. 3, 2008

feature freeze

by jcid＠dillo.org

On Thu, Oct 02, 2008 at 11:51:31PM +0100, Jeremy Henty wrote: > On Thu, Oct 02, 2008 at 03:20:02PM -0700, Kelson Vibber wrote: > > > [snip: excellent summary of the purpose of the HttpOnly cookie attr] > > > > So long as Dillo doesn't have client-side scripting, the attribute > > can just be ignored. > > OK, patch attached. (NB: the patch context depends on my previous > MSG-enhancing patch, but I think it will apply with a little fuzz even > without it.) Committed as: - MSG("Cookie contains illegal attribute!\n"); + MSG("Cookie contains unknown attribute: '%s'\n", attr); -- Cheers Jorge.-

Oct. 3, 2008

an experiment regarding cross site request forgery

by 4winter＠informatik.uni-hamburg.de

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 corvid wrote: > Justus wrote: >> Johannes Hofmann wrote: >>> Perhaps we should be more careful when to send out a cookie. >>> What about not sending cookies with image requests, if the host of >>> the image url is different from the one in the main page? >>> What do other browser do about this? >> Yes, I think this is the way to go. One need to decide when to send out >> authentication credentials (legitimate session) and when to strip them >> (CSRF attempt). Martin Johns and I developed a firefox extension [0] >> that does exactly this. Please see [1] pages 29 - 37 or [2] for more >> information. [1] is also a pretty good introduction to CSRF. Please note >> that the browser independent proxy solution is deprecated (but should >> work unless the twisted framework changed its api too much) and the >> firefox extension is somewhat unmaintained at the moment... > > Having done some reading now: > So for an HTTP redirect or an image request, A->B, > I gather up the cookies that I would send when asking for B > and discard those that I would not send if I were asking for A? I am not sure I understand your question. The basic csrf scenario is the following: 1. you log in to some web application hosted at good.org 2. with the same browser instance using another window or tab (or you just forget to log out and reused the same window) you visit evil.org 3. evil.org hosts an html page that triggers an request to good.org, either using an image/script/style/object/whatever tag in case of an GET request or using an form and javascript / css to submit the form 4. your browser sends any authentication credentials like cookies along with the request since they are associated with the target host thus allowing evil.org to change the state of your good.org account on your behalf The proper thing to do is to fix this on the server side, but since csrf isn't as widely known as xss many web applications are vulnerable to this problem. Justus -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFI5h9woPmwNWhsaZYRAiGUAJ42ZuicB6aYGYkrjDZj2lSRpB6h1QCcCJ38 +zhCOeq1aO0Q747/tfeAQoU= =4QtQ -----END PGP SIGNATURE-----

Oct. 3, 2008

feature freeze

by corvid＠lavabit.com

Kelson wrote: > So long as Dillo doesn't have client-side scripting, the attribute can > just be ignored. I was looking through the RFCs to see what the rule was regarding unknown attributes, and I was able to find in rfc2965, for Set-Cookie2: "The user agent MUST ignore attribute-value pairs whose attribute it does not recognize", and in rfc2109, "An 'old' client that receives a 'new' cookie will ignore attributes it does not understand..." So it does sound like dillo can ignore unknown attributes rather than regarding them as errors. PS The cookie RFCs do not seem very clearly written in general.

Oct. 3, 2008

findbar sometimes stops accepting input

by corvid＠lavabit.com

I've seen this a couple times now...I can't remember whether it started before the last revision to findbar.cc. I can still highlight the findbar text, but I can't change it. I think closing/reopening the bar has always fixed it so far.

Oct. 3, 2008

feature freeze

by onepoint＠starurchin.org

On Thu, Oct 02, 2008 at 03:20:02PM -0700, Kelson Vibber wrote: > [snip: excellent summary of the purpose of the HttpOnly cookie attr] > > So long as Dillo doesn't have client-side scripting, the attribute > can just be ignored. OK, patch attached. (NB: the patch context depends on my previous MSG-enhancing patch, but I think it will apply with a little fuzz even without it.) And now I must away to correct every Wikipedia update since I last logged in. I may be some time. :-) Regards, Jeremy Henty

Oct. 3, 2008

feature freeze

by kelson＠pobox.com

Jeremy Henty wrote: > Dillo won't let me login to Wikipedia! Of course this may be a *good* > thing. :-) After making the MSG a little more verbose (patch > attached) it reports that it is rejecting the HttpOnly attribute (log > attached). I *think* this attribute is a security feature to avoid > hacks that trick your browser into relaying cookie info from an http > connection to an https connection. What should dillo do here? The HttpOnly flag indicates that the cookie should only be passed via HTTP requests and not accessible by client-side scripts. The idea is to make cross-site scripting attacks harder by preventing an injected script from accessing a site's authentication tokens or other data stored in cookies. So long as Dillo doesn't have client-side scripting, the attribute can just be ignored. More info: http://msdn.microsoft.com/en-us/library/ms533046.aspx http://www.owasp.org/index.php/HTTPOnly The second link includes a table of current support in various browsers. -- Kelson Vibber Hyperborea.org - SpeedForce.org - AlternativeBrowserAlliance.com

Oct. 3, 2008