Strengthening Web Security with Secure Cookie Attributes

Cookies are small pieces of data that a server sends to a user’s web browser when they visit a website. The browser stores the cookies and sends them back to the same server with subsequent requests. Cookies are mainly used for three purposes: session management (e.g., logins, shopping carts), personalization (e.g., user preferences), and tracking (e.g., recording user behavior).

However, cookies can also pose security risks if they are not properly protected from unauthorized parties who may intercept them during transmission or access them from the user’s device. For example, an attacker may steal a user’s session cookie and impersonate them on a website or use their personal information for malicious purposes.

To prevent these scenarios, web developers need to secure their cookies using various attributes that limit the scope and exposure of the cookies. One of these attributes is the secure attribute , which we will explain in this article.

The secure attribute is an option that can be set by the web server when sending a new cookie to the user within an HTTP response. The purpose of the secure attribute is to prevent cookies from being observed by unauthorized parties due to the transmission of the cookie in clear text. To accomplish this goal, browsers that support the secure attribute will only send cookies with the secure attribute when the request is going to an HTTPS page. In other words, the browser will not send a cookie with the secure attribute set over an unencrypted HTTP request. By setting the secure attribute, the browser will prevent the transmission of a cookie over an unencrypted channel. This helps mitigate the man-in-the-middle (MitM) attack, where an attacker intercepts and modifies the traffic between the user and the server.

Setting the secure attribute for a cookie depends on the technology used by the web server. Here are some examples of how to set the secure attribute in different technologies:

Java Servlets: Since version 6 (Servlet class version 3), Java EE supports secure attribute in Cookie interface. Methods setSecure and isSecure can be used to set and check for secure value in cookies. For example:

Cookie cookie = new Cookie(“name”, “value”); cookie.setSecure(true); //set secure attribute response.addCookie(cookie); //send cookie to browser
ASP.NET: Set the following in Web.config:

This will enable the secure attribute on all cookies sent by the application. For some objects that have a requireSSL property, such as the forms Authentication Cookie, set the requireSSL="true" attribute in the web.config for that specific element. For example:

<authentication mode="Forms">
<forms loginUrl="member_login.aspx" cookieless="UseCookies" requireSSL="true" path="/" />
</authentication>

PHP: Use the setcookie function with the secure parameter set to true. For example:

setcookie(“name”, “value”, time() + 3600, ”/”, "", true); //set secure attribute
Node.js: Use the cookie-parser middleware with the secure option set to true. For example:

var express = require(‘express’); var cookieParser = require(‘cookie-parser’); var app = express(); app.use(cookieParser()); app.get(’/’, function(req, res){ res.cookie(‘name’, ‘value’, {secure: true}); //set secure attribute res.send(‘Hello World’); }); app.listen(3000);

Using the secure attribute for cookies has several benefits for web applications, such as:

Security: The secure attribute prevents cookies from being sent over unencrypted HTTP requests, which can be intercepted and modified by attackers. This reduces the risk of session hijacking, identity theft, or data leakage.
Privacy: The secure attribute ensures that cookies are only sent to HTTPS pages, which are encrypted and authenticated by default. This protects the user’s privacy and prevents third parties from accessing or tracking their online activities.
Performance: The secure attribute reduces the network overhead and bandwidth consumption by preventing unnecessary cookie transmissions over HTTP requests. This improves the performance and efficiency of web applications.

While using the secure attribute for cookies is a good practice, it does not guarantee complete protection for cookies from other threats, such as:

Cross-site scripting (XSS): This is a type of attack where an attacker injects malicious code into a web page that executes in the user’s browser. The malicious code can access and manipulate any cookies stored in the browser, regardless of their attributes. To prevent XSS attacks, web developers need to sanitize and validate any user input or output that may contain executable code.
Cross-site request forgery (CSRF): This is a type of attack where an attacker tricks a user into performing an unwanted action on a website where they are already logged in. The attacker can exploit the user’s authenticated session by sending a forged request that includes their cookies. To prevent CSRF attacks, web developers need to use anti-CSRF tokens or other methods that verify the origin and integrity of requests.
Cookie theft by malicious scripts or users: This is a type of attack where an attacker gains access to a user’s device or browser and steals their cookies from local storage or memory. The attacker can then use these cookies to impersonate or exploit the user on other websites. To prevent cookie theft, web developers need to use encryption or hashing techniques to protect sensitive data stored in cookies.

To test if a website uses secure attribute for its cookies, you can use tools such as browser developer tools or OWASP ZAP. Here are some steps to follow:

Open the website in your browser and inspect the network traffic using the developer tools (e.g., press F12 in Chrome).
Look for the Set-Cookie header in the HTTP response and check if it has the secure flag set (e.g., Set-Cookie: name=value; secure).
Alternatively, you can also look for the Cookie header in the HTTP request and check if it has the secure flag set (e.g., Cookie: name=value; secure).
If the secure flag is not set, then the website is not using secure attribute for its cookies and may be vulnerable to MitM attacks.
You can also use OWASP ZAP, which is a free and open source web application security scanner. It can automatically scan a website for various vulnerabilities, including insecure cookies.
To use OWASP ZAP, you need to download and install it from https://www.zaproxy.org/download/.
Then, you need to configure your browser to use ZAP as a proxy server (e.g., localhost:8080).
Next, you need to launch ZAP and start a new session. You can either enter the URL of the website you want to scan or use the browser as normal and let ZAP record the traffic.
After that, you need to run the active scan on the website by clicking on the Scan button in ZAP.
Finally, you need to check the results of the scan and look for any alerts related to insecure cookies. You can also view the details of each alert and see the HTTP request and response that triggered it.

Conclusion

In this article, we have explained what secure attribute is, how it works, how to set it, what are its benefits and limitations, and how to test for it. We have learned that secure attribute is an important feature that enhances the security, privacy, and performance of web applications by preventing cookies from being sent over unencrypted HTTP requests. We have also learned that secure attribute does not protect cookies from other threats such as XSS, CSRF, or cookie theft, and that web developers need to use other techniques to secure their cookies.

Some of the best practices for web developers regarding secure attribute are:

Use HTTPS for all pages that handle sensitive data or require authentication.
Set secure attribute for all cookies that contain sensitive data or are used for session management.
Use different technologies such as Java Servlets, ASP.NET, PHP, Node.js etc. to set secure attribute according to your needs.
Use tools such as browser developer tools or OWASP ZAP to test if your website uses secure attribute for its cookies.
Keep yourself updated with the latest standards and recommendations regarding cookie security.