SSL Cookie

[soledue]

how to marked the cookies with the "secure" attribute with apache + openssl?

[Farshad Mohajeri]

I never heard of secure cookies. Can you send a link regarding it?

[soledue]

IIS 4.0 and 5.0 Fix Information:

http://support.microsoft.com/default.aspx?scid=kb;en-us;274149

Remediation for IIS 6.x:

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/0d49cbc8-10e1-4fa8-ba61-

c34e524a3ae6.mspx?mfr=true

http://msdn2.microsoft.com/en-us/library/ms998310.aspx

Require SSL for an Authentication Cookie (IIS 7):

http://technet.microsoft.com/en-us/library/cc771633(WS.10).aspx

AnonymousIdentificationSection Class [iIS 7]:

http://msdn.microsoft.com/en-us/library/ms689482.aspx

Use the following links to remediate this issue on an Apache server:

http://search.cpan.org/~jkrasnoo/ApacheCookieEncrypted-0.03/Encrypted.pm

http://hc.apache.org/httpclient-3.x/apidocs/org/apache/commons/httpclient/class-use/Cookie.html

 

I never heard of secure cookies. Can you send a link regarding it?

[soledue]

Encrypt the contents of the header using encryption agreed upon between server administration and the clients. Or, more simply, you may encrypt server-browser exchanges with the SSL security switch in the cookie header. This feature, the SECURE attribute, allows you to limit the cookies' use to a secure channel (such as SSL). To enable this feature, set SECURE to TRUE. You can go a step further by installing an SSL certificate on your Apache server. Then your cookie exchanges will be SSL-encrypted.

[soledue]

In other words I need mark uni_gui_session_id with Secure attribute like this:

Set-Cookie: LSID=DQAAAK…Eaem_vYg; Domain=docs.foo.com; Path=/accounts; Expires=Wed, 13-Jan-2021 22:23:01 GMT; Secure; HttpOnly

 

 

is possible?

[Farshad Mohajeri]

I'll look at the issue.

[soledue]

in unit ExtUtils exist a function with a secure attribute:

function TExtUtilCookiesSingleton.SetJS(Name, Value: String; Expires: TExtObject = nil; Path: String = ''; Domain: String = ''; Secure: Boolean =false): TExtFunction;

 

 

I'll look at the issue.

[Farshad Mohajeri]

TUniGUICookies.SetCookie() eveloded into:

 

procedure TUniGUICookies.SetCookie(const ACookieName, AValue: string; AExpires: TDateTime=0.0; ASecure: Boolean=False; AHTTPOnly:Boolean=False; const APath:string='/' );

I haven't tested it though.

 

This will be available in next build.

[soledue]

Thank you very much would be great if I could set secure attribute also to the session_ id cookie

 

TUniGUICookies.SetCookie() eveloded into:

 

procedure TUniGUICookies.SetCookie(const ACookieName, AValue: string; AExpires: TDateTime=0.0; ASecure: Boolean=False; AHTTPOnly:Boolean=False; const APath:string='/' );

I haven't tested it though.

 

This will be available in next build.

[Farshad Mohajeri]

Thank you very much would be great if I could set secure attribute also to the session_ id cookie

 

 

 

Why is it needed?

[soledue]

you know that something almost absurd, but I'm making as the application is for a bank and must meet certain safety criteria

 

Why is it needed?

[Farshad Mohajeri]

session_id is only optional and not used internally to track session. It has no meaning for app. unigui doesn't track sessions by cookies.