Need

Secure generation and handling of cookies

Context

• Usage of Ruby 2.0+ for developing Ruby applications
• Usage of Rails for building web applications

Description

Non compliant code

        class ApplicationController < ActionController::Base
  def set_cookie
    cookies[:user] = "admin"
  end
end
        
        

In the provided code snippet, a cookie is being set without any security attributes. The set_cookie method in the ApplicationController class sets a cookie named user with a value of admin.

This cookie is insecure because it lacks the secure, httponly, and samesite attributes. The secure attribute ensures that the cookie is only sent over HTTPS, preventing it from being intercepted by attackers. The httponly attribute prevents the cookie from being accessed through client-side scripts, which can help to mitigate cross-site scripting (XSS) attacks. The samesite attribute can help to prevent cross-site request forgery (CSRF) attacks by ensuring that the cookie is only sent with requests originating from the same site.

Without these attributes, the cookie could be intercepted in transit or accessed by unauthorized users on the client side, potentially leading to unauthorized access or other security issues.

Steps

• Use the 'secure' flag when setting sensitive cookies to ensure they are only transmitted over HTTPS.
• Set the 'httponly' flag for sensitive cookies to prevent client-side scripts from accessing them.
• Use a strong and unique secret key for cookie encryption to prevent tampering and session hijacking.
• Implement a secure session management mechanism, such as using a secure session store or database, to store session data instead of relying solely on cookies.
• Regularly update and patch the Ruby on Rails framework and its dependencies to ensure you have the latest security fixes.
• Perform regular security audits and penetration testing to identify and address any potential vulnerabilities in the application.

Compliant code

        class ApplicationController < ActionController::Base
  def set_cookie
    cookies[:user] = { value: "admin", secure: Rails.env.production?, httponly: true }
  end
end
        
        

The updated code now sets the secure and httponly flags when creating the user cookie.

The secure flag is set to true only in a production environment. This ensures that the cookie is only sent over HTTPS, which encrypts the data during transmission, preventing it from being intercepted and read by unauthorized users. In a non-production environment, the secure flag is set to false for testing purposes.

The httponly flag is set to true, which prevents client-side scripts (like JavaScript) from accessing the cookie. This is a security measure that helps mitigate cross-site scripting (XSS) attacks, where an attacker might try to access the cookie through a script.

This code assumes that you are using a secure and unique secret key for cookie encryption, and that you have a secure session management mechanism in place. It's also important to keep your Ruby on Rails framework and its dependencies up-to-date with the latest security patches, and to perform regular security audits and penetration testing to identify and fix any potential vulnerabilities.

References

• 042. Insecurely generated cookies