Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:16867
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Date: Thu, 23 Jun 2005 02:15:40 +0200
Reply-To: Marcus Boerger <mail@marcus-boerger.de>
Message-ID: <1587152561.20050623021540@marcus-boerger.de>
To: Jochen Hansper <hansper@t-online.de>
Cc: internals@lists.php.net
In-Reply-To: <1119485004.7376.20.camel@mframe.test-lab>
References: <1119485004.7376.20.camel@mframe.test-lab>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] httpOnly Cookies [tiny enhancement]
From: mail@marcus-boerger.de (Marcus Boerger)

Hello Jochen,

  please resend your patch as unified patch (cvs di -u).

marcus

Thursday, June 23, 2005, 2:03:24 AM, you wrote:

> Hi,

> Internet Explorer 6 SP1 supports the cookie attribute "httponly" which
> prevents reading cookies from JavaScript or the like. This can help to
> mitigate XSS session hijacking. Browsers not supporting this cookie
> attribute are not disturbed if it is present.

> AFAIK PHP does not support httponly cookies. So here's a patch that will
> add support for it in PHP4. 
> (files ext/session/session.c and ext/session/session_php.h have to be
> changed)

> After you apply the changes (and recompile), you can add a line like
> this in php.ini:

> session.cookie_httponly=1

> It enables httpOnly cookies. Default value ist 0 (off, if line is
> missing).


> /****diff for session.c****/
> bash#diff ./ext/session/session.c ./ext/session/session_with_httponly.c

> 142d141
> <       STD_PHP_INI_BOOLEAN("session.cookie_httponly",    "0",         
> PHP_INI_ALL, OnUpdateBool,   cookie_httponly,      php_ps_globals,   
> ps_globals)
> 857d855
> < #define COOKIE_HTTPONLY "; httponly"
> 911,914d908
> <       if (PS(cookie_httponly)) {
> <               smart_str_appends(&ncookie, COOKIE_HTTPONLY);
> <       }
> <
> 1140c1134
> < /* {{{ proto void session_set_cookie_params(int lifetime [, string
> path [, string domain [, bool secure [, bool httponly]]]])
> ---
>> /* {{{ proto void session_set_cookie_params(int lifetime [, string
>> path [, string domain [, bool secure]]])
> 1144c1138
> <       zval **lifetime, **path, **domain, **secure, **httponly;
> ---
>>       zval **lifetime, **path, **domain, **secure;
> 1149,1150c1143,1144
> <       if (ZEND_NUM_ARGS() < 1 || ZEND_NUM_ARGS() > 5 ||
> <               zend_get_parameters_ex(ZEND_NUM_ARGS(), &lifetime,
> &path, &domain, &secure, &httponly) == FAILURE)
> ---
>>       if (ZEND_NUM_ARGS() < 1 || ZEND_NUM_ARGS() > 4 ||
>>               zend_get_parameters_ex(ZEND_NUM_ARGS(), &lifetime,
>> &path, &domain, &secure) == FAILURE)
> 1167,1170d1160
> <                       if (ZEND_NUM_ARGS() > 4) {
> <                               convert_to_long_ex(httponly);
> <                              
> zend_alter_ini_entry("session.cookie_httponly",
> sizeof("session.cookie_httponly"), Z_BVAL_PP(httponly)?"1":"0", 1,
> PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
> <                       }
> 1190d1179
> <       add_assoc_bool(return_value, "httponly", PS(cookie_httponly));




> /****diff for session_php.h****/
> bash#diff ./ext/session/php_session.h  
> ./ext/session/php_session_with_httponly.h

> 106d105
> <       zend_bool  cookie_httponly;


> ---------------------------

> Keep in mind that the added protection by httpOnly cookies can be
> circumvented by XST-style attacks...

> Hope this is useful....



>                                                         Jochen




-- 
Best regards,
 Marcus                            mailto:mail@marcus-boerger.de