1

We have an option for secure cookie check in Magento 1.9.1 as per Magento Community Edition 1.9.1 release notes

  • Added a secure cookie flag for the storefront to prevent man-in-the-middle attacks. There is no change to the Secure and Unsecure Web configuration options.

Does this help to overcome this OWASP-2010: A3, issue?

app\code\core\Mage\Core\Model\Session\Abstract\Varien.php

.

      if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
        // secure cookie check to prevent MITM attack
        $secureCookieName = $sessionName . '_cid';
        if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
            && $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
        ) {
            session_regenerate_id(false);
            $sessionHosts = $this->getSessionHosts();
            $currentCookieDomain = $cookie->getDomain();
            foreach (array_keys($sessionHosts) as $host) {
                // Delete cookies with the same name for parent domains
                if (strpos($currentCookieDomain, $host) > 0) {
                    $cookie->delete($this->getSessionName(), null, $host);
                }
            }
            $_SESSION = array();
        }
        if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
            $checkId = Mage::helper('core')->getRandomString(16);
            $cookie->set($secureCookieName, $checkId, null, null, null, true);
            $_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);
        }
    }

How can I implement this feature in lower versions of Magento without upgrading to higher version? Do we have some patch or workaround for this?

1 Answer 1

1

I created a local copy of Varien.php file at following location

app\code\local\Mage\Core\Model\Session\Abstract\Varien.php

On top of file add

const SECURE_COOKIE_CHECK_KEY = '_secure_cookie_check';

Go to public function start($sessionName=null) method and add following lines after session_start()

if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
// secure cookie check to prevent MITM attack
$secureCookieName = $sessionName . '_cid';
if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
    && $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
) {
    session_regenerate_id(false);
    $sessionHosts = $this->getSessionHosts();
    $currentCookieDomain = $cookie->getDomain();
    foreach (array_keys($sessionHosts) as $host) {
        // Delete cookies with the same name for parent domains
        if (strpos($currentCookieDomain, $host) > 0) {
            $cookie->delete($this->getSessionName(), null, $host);
        }
    }
    $_SESSION = array();
}
if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
    $checkId = Mage::helper('core')->getRandomString(16);
    $cookie->set($secureCookieName, $checkId, null, null, null, true);
    $_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);
}
}

When ever we move to a secure page it creates a new cookie with sessionname_cid ( $secureCookieName = $sessionName . '_cid';)

3
  • Does this will add secure attribute to all magento cookies ? Sep 17, 2020 at 8:59
  • No, I think only to customer session cookie.
    – Mukesh
    Sep 17, 2020 at 9:28
  • Is their any way we can setting up (Secure & HttpOnly) attribute on all cookies ? Sep 17, 2020 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.