Repository navigation
Replies: 1 comment 10 replies
|
Related discussion #16747 |
|
It must still be used for something since the whole login process breaks if you add HttpOnly to the session cookie. It ends up in an endless redirect loop. |
|
It is at least used for OIDC Session Management in the OP iFrame, see https://openid.net/specs/openid-connect-session-1_0.html#OPiframe. Quote: "If a cookie is used to maintain the OP User Agent state, the HttpOnly flag likely cannot be set for this cookie because it needs to be accessed from JavaScript. Therefore, information that can be used for identifying the user should not be put into the cookie, as it could be read by unrelated JavaScript." |
|
I came across that same thing, but my question is there any plans to change how that mechanism works so it does not rely on cookies being accessed by javascript for session validation? |
|
I am not an expert on this matter but if I understand the mechanism correctly, Javascript needs to be able to access a certain piece of information. So even if you change the mechanism to use something different (encoding into the URL maybe?), the same piece of information would have to be available to Javascript. So I don't really see the point in changing it. But maybe somebody else has a more detailed knowledge on this. |
|
We will not be changing this, as it is required for some parts of Keycloak to work. Your time is better spent on making sure scripts do not execute on the page that could be used to extract any information by using measures such as a content security policy. The cookie contains user session ID, which is hashed by SHA-256 and URL encoded. Yes, it could be hijacked, but so could many other things if you can get a user to execute unwanted code. |
Uh oh!
There was an error while loading. Please reload this page.
Hi,
is it possible to force HttpOnly=true flag on this cookie?
Regards.
All reactions