Exclude attacker-planted-cookie attacks from the threat model#1314
Merged
Conversation
Attacks that require injecting attacker-chosen cookies into the victim's browser (e.g. OIDC login CSRF / session fixation via a forged login-flow -state cookie) are out of scope: SQLPage assumes its origin cookie jar is writable only by the user agent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents that attacks requiring the attacker to write cookies into the victim's browser are out of scope.
This is the precondition behind the OIDC login-CSRF / session-fixation class (forged
sqlpage_oidc_state_*cookie). Signing the cookie does not close it (an attacker can copy a validly server-signed cookie from their own flow), and a server-side one-time state store does not either (the attacker's state is validly issued and consumed once by the victim). The realistic defense is cookie-injection hardening, but defending against an attacker who can already write cookies to the exact origin is not something SQLPage can guarantee.Adds one bullet to the Out of Scope list in
SECURITY.md. Docs only.