51369b610e
When an include is not surrounded by empty lines, its content is inlined on the same line as the adjacent content. That can lead to broken tags and other display issues. This PR fixes all such includes and introduces a validation step that forbids introducing the same problem again.
61 lines
2.0 KiB
Plaintext
61 lines
2.0 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
When the ``++HttpCookie.HttpOnly++`` property is set to ``++false++`` then the cookie can be accessed by client side code:
|
|
|
|
----
|
|
HttpCookie myCookie = new HttpCookie("Sensitive cookie");
|
|
myCookie.HttpOnly = false; // Sensitive: this cookie is created with the httponly flag set to false and so it can be stolen easily in case of XSS vulnerability
|
|
----
|
|
The https://docs.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly?view=netframework-4.8[default value] of ``++HttpOnly++`` flag is ``++false++``, unless overwritten by an application's configuration file:
|
|
|
|
----
|
|
HttpCookie myCookie = new HttpCookie("Sensitive cookie");
|
|
// Sensitive: this cookie is created without the httponly flag (by default set to false) and so it can be stolen easily in case of XSS vulnerability
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
Set the ``++HttpCookie.HttpOnly++`` property to ``++true++``:
|
|
|
|
[source,csharp]
|
|
----
|
|
HttpCookie myCookie = new HttpCookie("Sensitive cookie");
|
|
myCookie.HttpOnly = true; // Compliant: the sensitive cookie is protected against theft thanks to the HttpOnly property set to true (HttpOnly = true)
|
|
----
|
|
Or change the default flag values for the whole application by editing the https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ms228262(v=vs.100)[Web.config configuration file]:
|
|
|
|
[source,csharp]
|
|
----
|
|
<httpCookies httpOnlyCookies="true" requireSSL="true" />
|
|
----
|
|
|
|
* the ``++requireSSL++`` attribute corresponds programmatically to the ``++Secure++`` field.
|
|
* the ``++httpOnlyCookies++`` attribute corresponds programmatically to the ``++httpOnly++`` field.
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Add the "HttpOnly" cookie attribute.
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|