logo

Database

Insecurely generated cookies - HttpOnly

Need

To protect cookies from being accessed by client-side scripts

Context

• Usage of Elixir for building scalable and fault-tolerant applications

• Usage of Plug Cowboy for building web applications in Elixir

• Usage of secure cookie handling for session management

Description

1. Non compliant code

defmodule Vulnerable do
  use Plug.Router

  plug :match
  plug :dispatch

  post "" do
    |> put_resp_cookie("sensitive_info", "some_value")...

In this Elixir code snippet, a cookie is being set without the HttpOnly attribute, making it susceptible to being read by client-side scripts.

2. Steps

• Set the HttpOnly attribute to true while setting the cookies.

• Do not store sensitive information in cookies if possible.

3. Secure code example

defmodule Secure do
  use Plug.Router

  plug :match
  plug :dispatch

  post "" do
    |> put_resp_cookie("sensitive_info", "some_value", http_only: true)...

In this Elixir code snippet, the cookie is set with the HttpOnly attribute set to true, protecting it from being read by client-side scripts.

On this page