Add HttpOnly flag to LiveJournal cookies

[gerg]

Title
Add HttpOnly flag to LiveJournal cookies

Short, concise description of the idea
Add the HttpOnly flag to LiveJournal cookies to help prevent against XSS.

Full description of the ideaThe only thing necessary is to set the HttpOnly flag on cookies sent by LiveJournal so that they cannot be accessed through client-side scripting. This makes

Comments

[soph]

As far as I know, LiveJournal already uses HttpOnly on its cookies. That's what I see in my Firefox's cookies.txt, anyway.

[gerg]

Strange, when I connect directly the HttpOnly flag isn't set. Firefox 3 moved to some obtuse sqlite database so I can't check it, but if you telnet to LJ and get the page source it definitely isn't setting HttpOnly, at least for ljuniq.

[soph]

Maybe it does browser sniffing? Try setting your User-Agent header when you connect directly. Mine is "Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14" if you need one to test with.

[edit: Mind you, I can confirm that for ljuniq, it doesn't seem to be using HttpOnly cookies. That one doesn't allow access to anything requiring security, though.]

[rebelsheart]

I personally support anything that makes LJ more secure to use. As this suggestion is way over my head, I'm not sure if it will receive the attention it deserves.

[hakeber]

+1

[soph]

I just double-checked using the Tamper Data extension for Firefox. All the cookies set during login have the HttpOnly flag set - ljmastersession, ljloggedin, BMLschemepref, langpref, and ljsession.

[gerg]

That's good to know. I'm tempted to delete this suggestion but I'd probably also want ljuniq to be http-only, if only because of what it's used for... I could picture situations where someone nefarious creates an XSS exploit to steal ljuniq cookies and do bad things which will be blamed on $innocent_user...

[azurelunatic]

Always best to warn & lock rather than delete a suggestion. FYI. :-P

[gerg]

Of course I would've bothered you in IRC before actually doing so. I know the rules. (And so do you :X)