CookiExt: Patching the browser against session hijacking attacks

Article type: Research Article

Authors: Bugliesi, Michele | Calzavara, Stefano^{; *} | Focardi, Riccardo | Khan, Wilayat

Affiliations: Università Ca’ Foscari Venezia, Venice, Italy. E-mails: bugliesi@dais.unive.it, calzavara@dais.unive.it, focardi@dais.unive.it, khan@dais.unive.it

Correspondence: [*] Corresponding author. E-mail: calzavara@dais.unive.it.

Abstract: Session cookies constitute one of the main attack targets against client authentication on the Web. To counter these attacks, modern web browsers implement native cookie protection mechanisms based on the HttpOnly and Secure flags. While there is a general understanding about the effectiveness of these defenses, no formal result has so far been proved about the security guarantees they convey. With the present paper we provide the first such result, by presenting a mechanized proof of noninterference assessing the robustness of the HttpOnly and Secure cookie flags against both web and network attackers with the ability to perform arbitrary XSS code injection. We then develop CookiExt, a browser extension that provides client-side protection against session hijacking, based on appropriate flagging of session cookies and automatic redirection over HTTPS for HTTP requests carrying these cookies. Our solution improves over existing client-side defenses by combining protection against both web and network attacks, while at the same time being designed so as to minimise its effects on the user’s browsing experience. Finally, we report on the experiments we carried out to practically evaluate the effectiveness of our approach.

Keywords: Browser security, session cookies, formal methods, noninterference

DOI: 10.3233/JCS-150529

Journal: Journal of Computer Security, vol. 23, no. 4, pp. 509-537, 2015