sus.botdocs

Security finding

A cookie is set with attributes that contradict each other or differ between pages

Security Warning Severity: Medium

Part of the audit Cookie attributes contradict each other or the connection. Finding id: security.cookieAttributeConflicts.

What it costs you

Attributes that contradict each other make the browser drop the cookie or protect it less than intended.

What to do

Set each cookie in one place with one set of attributes: Secure, HttpOnly for session cookies, and a SameSite value.

What it checks

  • Cross-site cookie without Secure flag
  • Secure cookie set over unsecured HTTP
  • Cookie name prefix rules violated
  • Same cookie with different flags per page
  • Session cookie readable by scripts on some pages

How to fix it

Add Secure to the SameSite=None cookie

  1. Search the code and the server and proxy configuration for every place that sets [name].
  2. Add Secure there. If no other site needs to send the cookie, use SameSite=Lax.

How to check: curl -sI [example url] | grep -i set-cookie

Set the cookie over HTTPS only

  1. Make the HTTP address answer with a redirect to HTTPS and nothing else, so no cookie is set there.

How to check: curl -sI [example url] | grep -i -E 'HTTP/|location|set-cookie' (expect a redirect and no Set-Cookie line)

Meet the rule of the cookie prefix

  1. A __Host- cookie must be set with Secure from an HTTPS page, with Path=/ and without a Domain attribute.
  2. A __Secure- cookie must be set with Secure from an HTTPS page.
  3. If [name] cannot meet the rule, rename it without the prefix.

How to check: curl -sI [example url] | grep -i set-cookie

Set the cookie in one place

  1. Search the code and the server and proxy configuration for every place that sets [name]. A proxy that rewrites cookies is a common second place.
  2. Keep one place, with Secure, a SameSite value, and HttpOnly for a session cookie.

How to check: curl -sI [example url] | grep -i set-cookie (repeat for a second page; the attributes of [name] must be the same)

How to verify by hand

No outside source needed.

What this relies on

The strictest instance is the intended one.