Securing our Applications is one of the most important task while moving to the production environment. Securing HttpSession is one of them. In this demonstration we will see how to use the HttpOnly cookies in “web.xml” using the tag “httpOnly”, Yes, this is a new feature added as part of Servlet3.0 Specification that we cna specify the httpOnly cookies directly using web.xml file.
The HttpOnly cookie is supported by most modern browsers. On a supported browser, an HttpOnly session cookie will be used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs (such as JavaScript). This restriction mitigates but does not eliminate the threat of session cookie theft via Cross-site scripting. It means on client side the cookies can not be accessed using java script or some other scripting utilities. This feature applies only to session-management cookies, and not other browser cookies.
Earlier in JBoss AS6 we had a feature called as “context.xml” using which we could define the cookies as “httpOnly” by either editing the “${PROFILE}/deploy/jbossweb.sar/context.sar/context.xml” file or by creating “conntext.xml” file inside our application “${YOUR_APP}/WEB-INF/context.xml” file as following:
In this demonstration we will be using JBoss AS7 ( jboss-as-7.1.0.Beta1 ) which can be downloaded from the following link:
And we will see how we can specify httpOnly cookies using the standard web descriptor “web.xml” file using servlet 3.0 specification.Step1). Create a Directory somewhere inside your file system where we can create our web application. Suppose i am creating a directory as “/home/userone/httpOnlyDemo” and the create a subdirectory with name “src” inside “/home/userone/httpOnlyDemo”
Step2). Now place the following kind of “web.xml” inside the “/home/userone/httpOnlyDemo/src” directory.
true
NOTE: The only thing here you need to kiip in mind that you are using the “web-app_3_0.xsd” in your “web.mxl” file pointing to version=”3.0″.
Step3). Now we will write a simple JSP Page in order to display the JSESSIONID cookie value in the browser with the help of Java Script. (Ideally the code should not be able to display the JSESSIONID cookie value with the help of java script here because we have marked out Cookie as “httpOnly”…so you can try both ways by enabling and disabling the http-only tag inside your web.xml to see what different you see while hitting the JSP Page.)
<% System.out.println("nt index.jsp is called...request="+request);%> Hi HttpOnly Hello CookieDemo "HttpOnly" !!!
NOTE: when you click on this button you should not be able to see the JSESSIONID cookie value in the textField if the http-only cookie is enabled. Step4). Now we will write a simple ant “build.xml” file in order to build and deploy our web application on JBoss AS7. So write the following “build.xml” file inside “/home/userone/httpOnlyDemo” as following:
NOTE: The only change in the above file you need to do is to change the “jboss.home” directory path in the second line of the above script is to point to your own JBoss AS7 directory home directory.
Step5). Now before running your ANT script to build and deploy the above webapplication you should have the ANT as well as JAVA set in the $PATH variable of the Shell / command prompt as following:
| 1 2 3 4 5 |
|
Step6). Now run the ant file from the directory where you have placed the “build.xml” file as following:
[userone@localhost httpOnlyDemo]$ antBuildfile: /home/userone/httpOnlyDemo/build.xmlinit: [delete] Deleting directory /home/userone/httpOnlyDemo/build [mkdir] Created dir: /home/userone/httpOnlyDemo/build [mkdir] Created dir: /home/userone/httpOnlyDemo/tmpbuild: [mkdir] Created dir: /home/userone/httpOnlyDemo/tmp/WEB-INF [copy] Copying 1 file to /home/userone/httpOnlyDemo/tmp [copy] Copying 1 file to /home/userone/httpOnlyDemo/tmp/WEB-INF [jar] Building jar: /home/userone/httpOnlyDemo/tmp/httpOnlyDemo.war [copy] Copying 1 file to /home/userone/httpOnlyDemo/builddeploy: [echo] ******************* Deploying the WAR file httpOnlyDemo.war ********************* [echo] ********** build/httpOnlyDemo.war to /home/userone/jboss-as-7.1.0.Beta1/standalone/deployments ********** [copy] Copying 1 file to /home/userone/jboss-as-7.1.0.Beta1/standalone/deployments [echo] ******************* Deployed Successfully *********************BUILD SUCCESSFULTotal time: 0 seconds
Step7). Now access the application like following: “” and then see whether you are able to see the JSESSIONID value or not? Also try removing the http-only tag from your web.xml file and then redeploy the application and then again try to access the application to check whether you are able to see the JSESSIONID cookie value or not .
Some more useful tags from Servlet 3.0 Specifications
You can get more details on these tags from the following link:
Also we can use some more useful tags in order to secure our WebAppications with the help of servlet3.0 tags present inside “web.xml” file like followingsecure cookie: A secure cookie is only used when a browser is visiting a server via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. This makes the cookie less likely to be exposed to cookie theft via eavesdropping.
true
tracking-mode cookie: tracking-mode element in the Servlet 3.0 specification allows you to define whether the JSESSIONID should be stored in a cookie or in a URL parameter. If the session id is stored in a URL parameter it could be inadvertently saved in a number of locations including the browser history, proxy server logs, referrer logs, web logs, etc. Accidental disclosure of the session id makes the application more vulnerable to session hijacking attacks. Instead, make sure the JSESSIONID is stored in a cookie if tracking-mode is set to COOKIE. The valid values for tracing-mode are COOKIE/SSL/URL
COOKIE
.
. Thanks MiddlewareMagic Team