RFC 6896 – Secure Cookie Sessions for HTTP(tools.ietf.org)

tools.ietf.org

RFC 6896 – Secure Cookie Sessions for HTTP

https://tools.ietf.org/html/rfc6896

9 comments

kpcyrd8 anni fa

It seems this has all disadvantages of jwt-style sessions, plus a BREACH-style vulnerability in the crypto due to compression if `plain-text-cookie-value` contains data an attacker can taint.

tptacek8 anni fa

Yeah, I'm pretty confused by this being on the front page.

ryacko8 anni fa

Worse: “SCS doesn't address replay of old cookie values.”

jamieson-becker8 anni fa

@moderators should probably be marked [2013]

chrismorgan8 anni fa

A better title:

RFC 6896 - SCS: KoanLogic's Secure Cookie Sessions for HTTP [2013]

jedisct18 anni fa

A better better title: RFC 6896 - SCS: KoanLogic's Insecure Cookie Sessions for HTTP [2013]

kerng8 anni fa

This doesn't seem to protect from Pass the Cookie attacks.

Edit - it's a common red teaming tactic: https://wunderwuzzi23.github.io/blog/passthecookie.html

0xfffff8 anni fa

Correct, it doesn't. If you grab that cookie and then pass the cookie from somewhere else it will work.

Section 7.2.3 talks about cookie theft.

kerng8 anni fa

Yeah, as others have pointed out this RFC is from 2013 - so a bit dated.