1

We have an option for secure cookie check in Magento 1.9.1 as per Magento Community Edition 1.9.1 release notes

  • Added a secure cookie flag for the storefront to prevent man-in-the-middle attacks. There is no change to the Secure and Unsecure Web configuration options.

Does this help to overcome this OWASP-2010: A3, issue?

app\code\core\Mage\Core\Model\Session\Abstract\Varien.php

.

      if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
        // secure cookie check to prevent MITM attack
        $secureCookieName = $sessionName . '_cid';
        if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
            && $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
        ) {
            session_regenerate_id(false);
            $sessionHosts = $this->getSessionHosts();
            $currentCookieDomain = $cookie->getDomain();
            foreach (array_keys($sessionHosts) as $host) {
                // Delete cookies with the same name for parent domains
                if (strpos($currentCookieDomain, $host) > 0) {
                    $cookie->delete($this->getSessionName(), null, $host);
                }
            }
            $_SESSION = array();
        }
        if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
            $checkId = Mage::helper('core')->getRandomString(16);
            $cookie->set($secureCookieName, $checkId, null, null, null, true);
            $_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);
        }
    }

How can I implement this feature in lower versions of Magento without upgrading to higher version? Do we have some patch or workaround for this?

1

I created a local copy of Varien.php file at following location

app\code\local\Mage\Core\Model\Session\Abstract\Varien.php

On top of file add

const SECURE_COOKIE_CHECK_KEY = '_secure_cookie_check';

Go to public function start($sessionName=null) method and add following lines after session_start()

if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
// secure cookie check to prevent MITM attack
$secureCookieName = $sessionName . '_cid';
if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
    && $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
) {
    session_regenerate_id(false);
    $sessionHosts = $this->getSessionHosts();
    $currentCookieDomain = $cookie->getDomain();
    foreach (array_keys($sessionHosts) as $host) {
        // Delete cookies with the same name for parent domains
        if (strpos($currentCookieDomain, $host) > 0) {
            $cookie->delete($this->getSessionName(), null, $host);
        }
    }
    $_SESSION = array();
}
if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
    $checkId = Mage::helper('core')->getRandomString(16);
    $cookie->set($secureCookieName, $checkId, null, null, null, true);
    $_SESSION[self::SECURE_COOKIE_CHECK_KEY] = md5($checkId);
}
}

When ever we move to a secure page it creates a new cookie with sessionname_cid ( $secureCookieName = $sessionName . '_cid';)

| improve this answer | |
  • Does this will add secure attribute to all magento cookies ? – Hamendra Sunthwal Sep 17 at 8:59
  • No, I think only to customer session cookie. – Mukesh Sep 17 at 9:28
  • Is their any way we can setting up (Secure & HttpOnly) attribute on all cookies ? – Hamendra Sunthwal Sep 17 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.