{"action":"closed","issue":{"url":"https://api.github.com/repos/clems4ever/authelia/issues/124","repository_url":"https://api.github.com/repos/clems4ever/authelia","labels_url":"https://api.github.com/repos/clems4ever/authelia/issues/124/labels{/name}","comments_url":"https://api.github.com/repos/clems4ever/authelia/issues/124/comments","events_url":"https://api.github.com/repos/clems4ever/authelia/issues/124/events","html_url":"https://github.com/clems4ever/authelia/issues/124","id":263680372,"number":124,"title":"Cookie theft","user":{"login":"n4kre","id":14371127,"avatar_url":"https://avatars2.githubusercontent.com/u/14371127?v=4","gravatar_id":"","url":"https://api.github.com/users/n4kre","html_url":"https://github.com/n4kre","followers_url":"https://api.github.com/users/n4kre/followers","following_url":"https://api.github.com/users/n4kre/following{/other_user}","gists_url":"https://api.github.com/users/n4kre/gists{/gist_id}","starred_url":"https://api.github.com/users/n4kre/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/n4kre/subscriptions","organizations_url":"https://api.github.com/users/n4kre/orgs","repos_url":"https://api.github.com/users/n4kre/repos","events_url":"https://api.github.com/users/n4kre/events{/privacy}","received_events_url":"https://api.github.com/users/n4kre/received_events","type":"User","site_admin":false},"labels":[{"id":495914890,"url":"https://api.github.com/repos/clems4ever/authelia/labels/enhancement","name":"enhancement","color":"84b6eb","default":true},{"id":654516164,"url":"https://api.github.com/repos/clems4ever/authelia/labels/P2","name":"P2","color":"d93f0b","default":false},{"id":713306159,"url":"https://api.github.com/repos/clems4ever/authelia/labels/security","name":"security","color":"006b75","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-10-07T23:44:37Z","updated_at":"2017-10-20T15:45:18Z","closed_at":"2017-10-20T15:45:18Z","author_association":"NONE","body":"Hi,\r\n\r\nAs of now, Authelia is likely vulnerable to session cookie theft via XSS – *cf.* [here](https://en.wikipedia.org/wiki/HTTP_cookie#Cross-site_scripting:_cookie_theft).\r\nA simple mitigation would be to set the `HttpOnly` attribute to the session cookie. This can be achieved through the addition of `httpOnly: true` in the cookie option, in `SessionConfigurationBuilder.js`.\r\n\r\n**Note**: Ensuring the cookie cannot be sent over an insecure HTTP connection would also be good from a security point of view (`secure: true`) – actually, this it can be a bit tricky due to the fact that Authelia is likely running over HTTP, even though it is behind an HTTPS reverse proxy: the idea is to configure Nginx with `proxy_set_header X-Forwarded-Proto $scheme;` before it forwards the HTTP request to Authelia's backend, and to ask the latter to trust such headers (hopefully, an attacker cannot spoof it, since Nginx will rewrite it, anyway), which you seem to have already implemented.\r\nThen, since the cookie is set to the “base” domain, such [an attack](https://en.wikipedia.org/wiki/HTTP_cookie#Publishing_false_sub-domain:_DNS_cache_poisoning) is possible. I would therefore highly promote in the `README` the use of [HSTS](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/) on *all* subdomains. Anyway, enforcing a strict transport security policy is good practice, not only for that specific reason – however, be careful with it: in the way I recommend to use HSTS, *all* subdomains must implement HTTPS; otherwise they will not be reachable. This would makes the `Secure` cookie attribute a bit useless, but it cannot hurt."}}
{"actor":{"display_login":"clems4ever"}}