Well, if you ask me, then yes, there is
a problem in the Corsaire paper,
since it doesn't mention that in almost
all of the cases, the cookie path is
useless for improving security.
From a best practise point of view, the path should be specified if
possible. However, that said (as noted in the Corsaire paper) it
doesn't have a lot of practical use whilst the same origin issues affect
the browsers. The 'same origin' label isn't mine; this was the term
that the browser vendors all seemed to use to describe the scenario
during discussions. I kind of got the impression that this was a term
they were familiar with. :p
Also, there is the javascript separation issue. Why is the HTTP agent
separation model not carried forward into javascript? By design, bad
implementation, or a simple flaw?
Martin...
----------------------------------------------------------------------
CONFIDENTIALITY: This e-mail and any files transmitted with it are
confidential and intended solely for the use of the recipient(s) only.
Any review, retransmission, dissemination or other use of, or taking
any action in reliance upon this information by persons or entities
other than the intended recipient(s) is prohibited. If you have
received this e-mail in error please notify the sender immediately
and destroy the material whether stored on a computer or otherwise.
----------------------------------------------------------------------
DISCLAIMER: Any views or opinions presented within this e-mail are
solely those of the author and do not necessarily represent those
of Corsaire Limited, unless otherwise specifically stated.
----------------------------------------------------------------------
Corsaire Limited, 3 Tannery House, Tannery Lane, Send, Surrey, GU23 7EF
Telephone: +44(0)1483-226000 Email:info@corsaire.com
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire's AppScan is the industry's first and leading web application
security testing suite, and the only solution to provide comprehensive
remediation tasks at every level of the application. Change the way you
think about application security testing - See for yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007kaF
--------------------------------------------------------------------------
