[ php-blog-Bugs-1547073 ] When using https for admin, cookies not always sent securely
"SourceForge.net" <[email protected]>
| Newsgroups | gmane.comp.serendipity.trackers |
|---|---|
| Message-ID | <[email protected]> |
Bugs item #1547073, was opened at 2006-08-26 12:19
Message generated for change (Comment added) made by lynoure
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1547073&group_id=75065
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Administrative functions
Group: None
Status: Open
Resolution: Accepted
Priority: 2
Submitted By: Lynoure Braakman (lynoure)
Assigned to: Garvin Hicking (garvinhicking)
Summary: When using https for admin, cookies not always sent securely
Initial Comment:
When the admin has been set to use https, the request
for serendipity_admin.css is still sent over plain http
and the cookies get sent along. This leaks the
authentication data which is stored in a cookie.
----------------------------------------------------------------------
>Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-29 22:21
Message:
Logged In: YES
user_id=267173
As things in php.ini will affect other php applications
too and require access to php.ini (not something all
Serendipity users have and anyway, one more thing to
configure), I made a little patch that makes Serendipity
use a different, secure php session cookie for https. I'm
using the patched version now myself.
The patch:
--- serendipity_config.inc.php (1.0.1 1312 2006-07-11)
+++ serendipity_config.inc.php 2006-08-29
21:57:46.000000000 +0300
@@ -3,6 +3,10 @@
# All rights reserved. See LICENSE file for licensing
details
if (!headers_sent()) {
+ if (!empty($_SERVER['HTTPS'])) {
+ ini_set('session.name', 'SSLSID');
+ ini_set('session.cookie_secure', '1');
+ }
session_start();
}
----------------------------------------------------------------------
Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-28 13:37
Message:
Logged In: YES
user_id=473563
Thanks for that feedback!
Regarding session cookies, you need to setup this in php.ini:
http://uk.php.net/manual/en/ref.session.php#ini.session.cookie-secure
Best regards,
Garvin
----------------------------------------------------------------------
Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-28 11:57
Message:
Logged In: YES
user_id=267173
I'm having a hectic day today but I'll probably be able to
try things more properly tomorrow.
A quick look showed that with my current setup the patch
seems to work fine for the serendipity_ cookies. That's
good and I didn't notice downsides to that. Thanks!
PHPSESSID is still shared. I have some theories of how
that could be changed (maybe by changing the name of the
session cookie for HTTPS and setting it secure with
ini_set and session.cookie_secure) but I'll get back about
that tomorrow.
----------------------------------------------------------------------
Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-27 20:00
Message:
Logged In: YES
user_id=473563
Hi!
Ah! Now I understand. I'm sorry that I didn'T get you
properly the last time.
I have prepared a patch:
http://garv.in/serendipity/secure.patch
Could you try to use that patch and see if it works for you?
If you don't know how to apply the patch, report back here
and I'll tell you how! :)
Best regards,
Garvin
----------------------------------------------------------------------
Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-27 16:35
Message:
Logged In: YES
user_id=267173
Alas, the new cookies got set with
Host: www.lynoure.org
Path: /blog/
Send for: any connection
www.lynoure.org is the sitename both for http and https,
so if I set the browser to not accept cookies from there,
that blocks all the cookies to the admin at
https://www.lynoure.org too.
Sorry for being unclear, there were no links that point to
http:// when viewing a https:// location but http:// links
from http:// location for admin functionalities like
editing and comment allowing. This is yes a logical result
of "Auto-Detect HTTP Host", I was just a bit confused
about it as first.
So, if the author_information cookie was created as a
secure cookie (send for https only) that would make things
safer as a third party could no longer easily get a cookie
granting long term access to the admin side. However, same
PHPSESSID is used in the admin and in reading the blog,
one can take that cookie from the http traffic and get
temporary access to admin with it.
(I've been looking for a blog engine that is nice and easy
to secure to the extent that it can be used as a business
blog without having to worry about a third party adding or
modifying entries. Serendipity is nice and very close to
that compared to the other engines I have tried.)
----------------------------------------------------------------------
Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-27 13:37
Message:
Logged In: YES
user_id=473563
Hi!
When you logged in once via HTTP this means that your cookie
is already set! Remove your cookie (via your browser's
interface) and then login to HTTPS, and you will not have a
HTTP cookie.
If there are links that point to http:// when viewing a
https:// location, we definitely would need to fix those.
Could you make a list of those? The comment link actually
does use https:// when I am browsing with https:// - they
should all use $serendipity['baseURL'] which gets the
https:// prefix when you use that URL.
Of course you could also configure your browser so that
cookies are not accepted on your http:// site...?
About secure cookies, you might want to check the
'serendipity_setcookie' function in
include/functions_config.inc.php?
Best regards,
Garvin
Best regards,
Garvin
----------------------------------------------------------------------
Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-27 12:25
Message:
Logged In: YES
user_id=267173
Unfortunately that was not enough. The author_information
cookie get sent even when browsing the non-admin side of
the blog.
Also some admin links appear when reading the blog (e.g.
Disallow commenting) and those are all http. Ironically
without "Auto-Detect HTTP Host" on those links are https.
Is there some way to constrain the sensitive cookies to
https by configuration? I have also been thinking of ways
of checking if admin has been set to use SSL and if so
setting secure true for the author_information
cookie.
----------------------------------------------------------------------
Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-26 16:32
Message:
Logged In: YES
user_id=267173
Thanks, that helped. Sorry for the hassle.
----------------------------------------------------------------------
Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-26 16:27
Message:
Logged In: YES
user_id=473563
Hi!
Ah! You must set "Auto-Detect HTTP Host" in your serendipity
configuration, so that the 'baseURL' directive will
automatically switch to the host you use.
Best regards,
Garvin
----------------------------------------------------------------------
Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-26 16:14
Message:
Logged In: YES
user_id=267173
Hmm, I'm using the 1.0.1
All other requests do go neatly by https except the one for
serendipity_admin.css
I think serendipity_rewriteURL is adding the http from
$serendipity['baseURL']. My base URL is http, only the
admin part is set to use ssl.
----------------------------------------------------------------------
Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-26 12:40
Message:
Logged In: YES
user_id=473563
Hi!
Which s9y version are you using? It works for me, since all
URLs in s9y's admin backend are either relative (and thus
use the current host) or if absolute, use the 'https://' prefix?
Best regards,
garvin
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1547073&group_id=75065
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642