[ php-blog-Bugs-1547073 ] When using https for admin, cookies not always sent securely

Bugs item #1547073, was opened at 2006-08-26 09:19
Message generated for change (Comment added) made by garvinhicking
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1547073&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Administrative functions
Group: None
Status: Open
Resolution: Accepted
Priority: 2
Submitted By: Lynoure Braakman (lynoure)
Assigned to: Garvin Hicking (garvinhicking)
Summary: When using https for admin, cookies not always sent securely

Initial Comment:
When the admin has been set to use https, the request
for serendipity_admin.css is still sent over plain http
and the cookies get sent along. This leaks the
authentication data which is stored in a cookie.

----------------------------------------------------------------------

>Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-28 10:37

Message:
Logged In: YES 
user_id=473563

Thanks for that feedback!

Regarding session cookies, you need to setup this in php.ini:

http://uk.php.net/manual/en/ref.session.php#ini.session.cookie-secure

Best regards,
Garvin

----------------------------------------------------------------------

Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-28 08:57

Message:
Logged In: YES 
user_id=267173

I'm having a hectic day today but I'll probably be able to 
try things more properly tomorrow. 

A quick look showed that with my current setup the patch 
seems to work fine for the serendipity_ cookies. That's 
good and I didn't notice downsides to that. Thanks!
PHPSESSID is still shared. I have some theories of how 
that could be changed (maybe by changing the name of the 
session cookie for HTTPS and setting it secure with  
ini_set and session.cookie_secure) but I'll get back about 
that tomorrow.

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-27 17:00

Message:
Logged In: YES 
user_id=473563

Hi!

Ah! Now I understand. I'm sorry that I didn'T get you
properly the last time.

I have prepared a patch:

http://garv.in/serendipity/secure.patch

Could you try to use that patch and see if it works for you?
If you don't know how to apply the patch, report back here
and I'll tell you how! :)

Best regards,
Garvin

----------------------------------------------------------------------

Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-27 13:35

Message:
Logged In: YES 
user_id=267173

Alas, the new cookies got set with 
Host: www.lynoure.org
Path: /blog/ 
Send for: any connection

www.lynoure.org is the sitename both for http and https, 
so if I set the browser to not accept cookies from there, 
that blocks all the cookies to the admin at 
https://www.lynoure.org too.


Sorry for being unclear, there were no links that point to 
http:// when viewing a https:// location but http:// links 
from http:// location for admin functionalities like 
editing and comment allowing. This is yes a logical result 
of "Auto-Detect HTTP Host", I was just a bit confused 
about it as first.


So, if the author_information cookie was created as a 
secure cookie (send for https only) that would make things 
safer as a third party could no longer easily get a cookie 
granting long term access to the admin side. However, same 
PHPSESSID is used in the admin and in reading the blog, 
one can take that cookie from the http traffic and get 
temporary access to admin with it. 

(I've been looking for a blog engine that is nice and easy 
to secure to the extent that it can be used as a business 
blog without having to worry about a third party adding or 
modifying entries. Serendipity is nice and very close to 
that compared to the other engines I have tried.)

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-27 10:37

Message:
Logged In: YES 
user_id=473563

Hi!

When you logged in once via HTTP this means that your cookie
is already set! Remove your cookie (via your browser's
interface) and then login to HTTPS, and you will not have a
HTTP cookie.

If there are links that point to http:// when viewing a
https:// location, we definitely would need to fix those.
Could you make a list of those? The comment link actually
does use https:// when I am browsing with https:// - they
should all use $serendipity['baseURL'] which gets the
https:// prefix when you use that URL.

Of course you could also configure your browser so that
cookies are not accepted on your http:// site...?

About secure cookies, you might want to check the
'serendipity_setcookie' function in
include/functions_config.inc.php?

Best regards,
Garvin
Best regards,
Garvin

----------------------------------------------------------------------

Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-27 09:25

Message:
Logged In: YES 
user_id=267173

Unfortunately that was not enough. The author_information 
cookie get sent even when browsing the non-admin side of 
the blog. 

Also some admin links appear when reading the blog (e.g. 
Disallow commenting) and those are all http. Ironically 
without "Auto-Detect HTTP Host" on those links are https.

Is there some way to constrain the sensitive cookies to 
https by configuration? I have also been thinking of ways 
of checking if admin has been set to use SSL and if so 
setting    secure true   for the author_information 
cookie.

----------------------------------------------------------------------

Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-26 13:32

Message:
Logged In: YES 
user_id=267173

Thanks, that helped. Sorry for the hassle. 

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-26 13:27

Message:
Logged In: YES 
user_id=473563

Hi!

Ah! You must set "Auto-Detect HTTP Host" in your serendipity
configuration, so that the 'baseURL' directive will
automatically switch to the host you use.

Best regards,
Garvin

----------------------------------------------------------------------

Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-26 13:14

Message:
Logged In: YES 
user_id=267173

Hmm, I'm using the 1.0.1

All other requests do go neatly by https except the one for
serendipity_admin.css

I think serendipity_rewriteURL is adding the http from 
$serendipity['baseURL'].  My base URL is http, only the
admin part is set to use ssl.

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-26 09:40

Message:
Logged In: YES 
user_id=473563

Hi!

Which s9y version are you using? It works for me, since all
URLs in s9y's admin backend are either relative (and thus
use the current host) or if absolute, use the 'https://' prefix?

Best regards,
garvin

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1547073&group_id=75065

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642