adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

[Security] Cookie missing 'HttpOnly' attribute #928

New Issue
Closed
opened 2026-10-05 04:53:40 +02:00 by adam · 4 comments
adam commented 2026-10-05 04:53:40 +02:00
Owner
Copy link
Copy source

The initial cookie given to the user when navigating to the ZNC home page lacks the HttpOnly attribute.

Strangely, the code that I believe is supposed to set this attribute looks like it should be working: https://github.com/znc/znc/blob/0ab205ccfa278eaa94063b4ad5e30d997e4c8311/src/HTTPSock.cpp#L745

The request when piped through Burp Suite's proxy, has the following response headers:

cookies

For more information about why this attribute is so important, refer to this article

  • Tested on ZNC 1.7.5
The initial cookie given to the user when navigating to the ZNC home page lacks the `HttpOnly` attribute. Strangely, the code that I believe is supposed to set this attribute looks like it should be working: https://github.com/znc/znc/blob/0ab205ccfa278eaa94063b4ad5e30d997e4c8311/src/HTTPSock.cpp#L745 The request when piped through Burp Suite's proxy, has the following response headers: ![cookies](https://user-images.githubusercontent.com/3712226/68064837-eff90080-fcee-11e9-902b-8da3b3b6ce8e.PNG) For more information about why this attribute is so important, refer to [this article](https://blog.codinghorror.com/protecting-your-cookies-httponly/) * Tested on ZNC 1.7.5 <!-- github-sync-id:516443094 -->
adam closed this issue 2026-10-05 04:53:40 +02:00
adam commented 2026-10-05 04:53:41 +02:00
Author
Owner
Copy link
Copy source

Looks like Burp Suite is messing with the cookie.

Looks like Burp Suite is messing with the cookie. <!-- github-comment-id:549025438 -->
adam commented 2026-10-05 04:53:42 +02:00
Author
Owner
Copy link
Copy source

Looks like Burp Suite is messing with the cookie.

Burp suite doesn't change responses. It only acts as a proxy server to watch traffic and re-send requests if desired.

I should also mention that this issue was first flagged by OpenVAS, so it's not an isolated incident.

> Looks like Burp Suite is messing with the cookie. Burp suite doesn't change responses. It only acts as a proxy server to watch traffic and re-send requests if desired. I should also mention that this issue was first flagged by OpenVAS, so it's not an isolated incident. <!-- github-comment-id:549049702 -->
adam commented 2026-10-05 04:53:42 +02:00
Author
Owner
Copy link
Copy source

Try without Burp. Does it still miss HttpOnly?

Try without Burp. Does it still miss HttpOnly? <!-- github-comment-id:549524860 -->
adam commented 2026-10-05 04:53:43 +02:00
Author
Owner
Copy link
Copy source

Tried that same request in Postman and the Set-Cookie header does have HttpOnly now. Strange.

Can't reproduce the problem so I'll close this issue.

Tried that same request in Postman and the Set-Cookie header does have HttpOnly now. Strange. Can't reproduce the problem so I'll close this issue. <!-- github-comment-id:549614568 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#928