gmane.comp.apache.mod-security.user

Forcing clients to enable cookies?

Dear all,

one of my customers has introduced a security policy by which all web applications have to do their session
handling via cookies. Rather than doing the boilerplate code in all web apps I'd like to check in only one
place if client browsers allow cookies and send them to an error page if not.

Is there a way to use mod_security to do the trick? Or would I be better off using mod_rewrite instead?
Conceptionally I would have set a cookie, force a reload, and on the next access, see if the cookie is still
there, right? But how can I do that? Would be great if someone could give me an idea!

Cheers
Stefan.

Resco GmbH
Geschäftsführer: Michael Mörchen
Amtsgericht Hamburg, HRB 76048
Ust.Ident-Nr.:DE208833022

Haftungsausschluss: Diese Nachricht ist ausschließlich für die Person oder Einheit bestimmt, an die
sie gerichtet ist. Sie enthält unter Umständen Informationen, die unter geltendem Recht
vertraulich, gesetzlich geschützt oder von der Offenlegung ausgeschlossen sind. Falls Sie nicht der
vorgesehene Empfänger oder verantwortlich für die Weiterleitung dieser Nachricht an den
vorgesehenen Empfänger sind, ist es Ihnen strengstens untersagt, diese Nachricht offenzulegen, zu
verteilen, zu kopieren oder in irgendeiner Art zu benutzen. Sollten Sie diese Nachricht versehentlich
erhalten haben, benachrichtigen Sie bitte den Absender und löschen und vernichten Sie jegliche Kopie
davon, die Sie möglicherweise erhalten haben.

Disclaimer: This message is intended only for the use of the individual or entity to which it is addressed
and may contain information which is privileged, confidential, proprietary, or exempt from disclosure
under applicable law. If you are not the intended recipient or the person responsible for delivering the

(Continue reading)

headers

Michael Renzmann | 9 May 11:37

Re: Forcing clients to enable cookies?

Hi.

> Is there a way to use mod_security to do the trick?

Well, in ScallyWhack I have some rules to block POST requests from clients
that have either no or not the right cookies set (see [1]); this has
proofed as a good way to block spam bots from Trac-driven sites. So yes,
basically it is possible to use mod-security for this purpose.

Bye, Mike
[1]
http://projects.otaku42.de/browser/scallywhack/trunk/modsecurity_sw_20_tracspam.conf#L35

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

headers

Stefan Müller-Wilken | 9 May 12:14

Re: Forcing clients to enable cookies?

Thanks, Mike, for the prompt answer.

>Well, in ScallyWhack I have some rules to block POST requests from clients
>that have either no or not the right cookies set (see [1]); this has
>proofed as a good way to block spam bots from Trac-driven sites. So yes,
>basically it is possible to use mod-security for this purpose.

But aren't things a little different here? You restrict your blocking rules to POST requests, thus giving
the browser a chance to pick up a cookie before forcing out requests without cookies. In my case I can't do
that because I don't know if applications use POSTs at all. I have to act on any kind of HTTP request.

What I think I need is a way to set cookies on requests (okay, easy) and then somehow identify subsequent
requests to check if the cookie is still there and act accordingly. And I don't know how to identify those
subsequent requests...

Cheers
 Stefan.

Resco GmbH
Geschäftsführer: Michael Mörchen
Amtsgericht Hamburg, HRB 76048
Ust.Ident-Nr.:DE208833022

Haftungsausschluss: Diese Nachricht ist ausschließlich für die Person oder Einheit bestimmt, an die
sie gerichtet ist. Sie enthält unter Umständen Informationen, die unter geltendem Recht
vertraulich, gesetzlich geschützt oder von der Offenlegung ausgeschlossen sind. Falls Sie nicht der
vorgesehene Empfänger oder verantwortlich für die Weiterleitung dieser Nachricht an den
vorgesehenen Empfänger sind, ist es Ihnen strengstens untersagt, diese Nachricht offenzulegen, zu
verteilen, zu kopieren oder in irgendeiner Art zu benutzen. Sollten Sie diese Nachricht versehentlich
erhalten haben, benachrichtigen Sie bitte den Absender und löschen und vernichten Sie jegliche Kopie

(Continue reading)

headers

Brian Rectanus | 9 May 18:59

Re: Forcing clients to enable cookies?

Stefan Müller-Wilken wrote:
> Dear all,
> 
> one of my customers has introduced a security policy by which all web
> applications have to do their session handling via cookies. Rather than
> doing the boilerplate code in all web apps I'd like to check in only one
> place if client browsers allow cookies and send them to an error page if
> not.
> 
> Is there a way to use mod_security to do the trick? Or would I be better
> off using mod_rewrite instead? Conceptionally I would have set a cookie,
> force a reload, and on the next access, see if the cookie is still
> there, right? But how can I do that? Would be great if someone could
> give me an idea!

ModSecurity cannot add cookies, so you would have to use mod_rewrite.
Conceptually you are correct, but it is not quite that easy because you
need to avoid a potential infinite loop of redirects if the browser does
not support cookies (ie you set a cookie and redirect, then there is no
cookie, so you repeat).  You have to redirect to a cookie test URI, then
if it is the cookie test URI, check for a cookie and then redirect back
to the correct URI.

Something like this (untested, but should give you some ideas):

### Check for a cookie + cookie test URI
RewriteCond %{HTTP_COOKIE} "!^$"
# Redirect back to the original page
RewriteRule ^/your/cookie/test/uri/(.*) $1 [R,L]

(Continue reading)

headers

Stefan Müller-Wilken | 9 May 23:57

Re: Forcing clients to enable cookies?

Hi there, Brian,
thanks for your help! I was so locked in on the idea of using mod_security that I've spent the afternoon
hunting down the setsid+response-modification trail but this looks _by_far more elegant. Reminds me of
what they say about tools: "if you've got a hammer everything looks like a nail!"

Anyways, no need  to worry, I don't get confused too easily  But then again, there indeed _IS_ one thing
that confuses me a bit: in your code snippet you nowhere actually set the cookie, right? Something along
the lines of ...

# Set environment variable and same time set a probing cookie
RewriteRule ^/your/entry/page - [E=checkcookie:1, CO=cookieprobe:yes:mydomain.com:1:/]

... would do the trick, no?

Cheers
 Stefan.

________________________________________
Von: Brian Rectanus [Brian.Rectanus <at> breach.com]
Gesendet: Freitag, 9. Mai 2008 18:59
An: Stefan Müller-Wilken
Cc: mod-security-users <at> lists.sourceforge.net
Betreff: Re: [mod-security-users] Forcing clients to enable cookies?

Stefan Müller-Wilken wrote:
> Dear all,
>
> one of my customers has introduced a security policy by which all web
> applications have to do their session handling via cookies. Rather than
> doing the boilerplate code in all web apps I'd like to check in only one

(Continue reading)

headers

Brian Rectanus | 10 May 00:33

Re: Forcing clients to enable cookies?

Stefan Müller-Wilken wrote:
> Hi there, Brian,
> thanks for your help! I was so locked in on the idea of using
> mod_security that I've spent the afternoon hunting down the
> setsid+response-modification trail but this looks _by_far more elegant.
> Reminds me of what they say about tools: "if you've got a hammer
> everything looks like a nail!"
> 
> Anyways, no need  to worry, I don't get confused too easily  But then
> again, there indeed _IS_ one thing that confuses me a bit: in your code
> snippet you nowhere actually set the cookie, right? Something along the
> lines of ...
> 
> # Set environment variable and same time set a probing cookie
> RewriteRule ^/your/entry/page - [E=checkcookie:1,
> CO=cookieprobe:yes:mydomain.com:1:/]
> 
> ... would do the trick, no?

Ah, yes, that would help ;)

-B

--

-- 
Brian Rectanus
Breach Security

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100.

(Continue reading)