RE: Cookies sent to different ports?

[Michael Silk <michaelsilk () gmail com>]

Hi Chuck,

  I think it's fine that cookies are tied to a domain and not a port + domain.

 Cookies are meant as a storage spot for the HOST to save information
about the client.

  If you have a scenario where you need to have different cookies per
port you can set it up relatively easily by adding cookies such as
"domain.cookieForPort123".

  If you are concerned from a security p.o.v. then simply don't allow
(you - as the server administrator) another untrusted (or unrelated)
server to run on the same host but different port.

  --

  As an example, we run multiple test sites - all under different
_domains_ not ports.

  --

  On the other side, however, I have been management consoles that run
specifically under a different port (sun's app server?) and if these
used cookies to save the information then there may be an issue ... or
if the administrator browsed to the standard site from the management
console.

  Of course, this means that the administrator cannot trust the
employees of the company that are developing the website ... but
perhaps this is a concern for some people :)

  (not to mention that if this is so perhaps there is other avenues
for them to explore).

-- Michael


> -----Original Message-----
> From: CFW [mailto:cfw_security () comcast net] 
> Sent: Wednesday, 15 December 2004 7:24 AM
> To: webappsec () securityfocus com
> Subject: Cookies sent to different ports?
>
> Hello all,
>
>    I have an observation about cookie behavior.  Scenario:
>
> - a user goes to a web server running at http://host:12345/,
> - host:12345 responds with a Set-Cookie: ... , PATH=/
> - user/browser goes to http://host:54321/ (same host as above)
>
>    Should the browser send the cookie with the GET of 
> http://host:54321/?
>
>    My answer would be no, it should not since host:54321 is a 
> different server (meaning process at least).  However, I have 
> checked this with both IE and Firefox and they happily send 
> the cookie along. 
>
>     Someone (thanks Matt) looked in to this for me a little 
> and it turns out that this is required by the RFC, cookies 
> are tied to host and protocol (HTTP or HTTPS, though I think 
> this is only sometime true through use of the "secure" cookie 
> tag), not to port.  It would seem that this may have some 
> implications in shared hosting environments, but usually 
> those will be separate hostnames (even if they reside on the 
> same IP).  There are also cases where a team may have multiple "test" 
> servers up on different posts of the same host, so this issue 
> could come out there as well.
>
>    Any thoughts?  Thanks.
>
> Chuck