Hi Chuck,
I think it's fine that cookies are tied to a domain and not a port + domain.
Cookies are meant as a storage spot for the HOST to save information
about the client.
If you have a scenario where you need to have different cookies per
port you can set it up relatively easily by adding cookies such as
"domain.cookieForPort123".
If you are concerned from a security p.o.v. then simply don't allow
(you - as the server administrator) another untrusted (or unrelated)
server to run on the same host but different port.
--
As an example, we run multiple test sites - all under different
_domains_ not ports.
--
On the other side, however, I have been management consoles that run
specifically under a different port (sun's app server?) and if these
used cookies to save the information then there may be an issue ... or
if the administrator browsed to the standard site from the management
console.
Of course, this means that the administrator cannot trust the
employees of the company that are developing the website ... but
perhaps this is a concern for some people :)
(not to mention that if this is so perhaps there is other avenues
for them to explore).
-- Michael
-----Original Message-----
From: CFW [mailto:cfw_security@comcast.net]
Sent: Wednesday, 15 December 2004 7:24 AM
To: webappsec@securityfocus.com
Subject: Cookies sent to different ports?
Hello all,
I have an observation about cookie behavior. Scenario:
- a user goes to a web server running at http://host:12345/,
- host:12345 responds with a Set-Cookie: ... , PATH=/
- user/browser goes to http://host:54321/ (same host as above)
Should the browser send the cookie with the GET of
http://host:54321/?
My answer would be no, it should not since host:54321 is a
different server (meaning process at least). However, I have
checked this with both IE and Firefox and they happily send
the cookie along.
Someone (thanks Matt) looked in to this for me a little
and it turns out that this is required by the RFC, cookies
are tied to host and protocol (HTTP or HTTPS, though I think
this is only sometime true through use of the "secure" cookie
tag), not to port. It would seem that this may have some
implications in shared hosting environments, but usually
those will be separate hostnames (even if they reside on the
same IP). There are also cases where a team may have multiple "test"
servers up on different posts of the same host, so this issue
could come out there as well.
Any thoughts? Thanks.
Chuck
