Werk #2391: Auth cookie is using "secure" flag when HTTPS request detected

Komponente User interface
Titel Auth cookie is using "secure" flag when HTTPS request detected
Datum 30.06.2015
Level Kleine Änderung
Klasse Sicherheitsfix
Kompatibilität Kompatibel - benötigt kein manuelles Eingreifen
Checkmk versions & editions
1.2.7i3 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

In previous versions the authentication cookie, which identifies an authenticated user with the GUI, was never using the "secure" flag. This means the cookie was sent to the webserver when doing HTTP and HTTPS requests. In such a situation a user which authenticated using HTTPS could access the GUI using HTTP and was still authenticated becaus the browser sends the HTTPS related cookie via HTTP. This is some kind of security risk since the information which should only be transported using the encrypted HTTPS requests could be transported in clear text over the network using HTTP.

The GUI tries now to detect the HTTPS requests. In case a HTTPS request is detected, the cookies are set with the "secure" flag which makes the cookies only used via HTTPS.

The HTTPS detection currently checks wether or not the HTTP request header X-Forwarded-Proto is set to https.

Zur Liste aller Werks