漏洞修复：Cookie Security: Overly Permissive SameSite Attribute

SangBigYe

已于 2022-02-08 11:41:33 修改

阅读量3.8k

点赞数

分类专栏： nginx 文章标签：安全漏洞

于 2022-02-07 09:49:23 首次发布

本文链接：https://blog.csdn.net/CutelittleBo/article/details/122732349

版权

nginx 专栏收录该内容

20 篇文章 0 订阅

订阅专栏

本文介绍了如何通过设置SameSite属性为Strict来保护网站免受CSRF攻击。主要内容包括理解SameSite属性的作用，展示了一个缺失Strict值的session cookie示例，并提供了在nginx和Shiro框架中配置SameSite=Strict的解决方案，确保只在安全上下文中发送cookies。

摘要由CSDN通过智能技术生成

描述

The SameSite attribute protects cookies from attacks such as Cross-Site Request Forgery (CSRF). Session cookies represent a user to the site to allow user to perform authorized actions. However, the browser automatically sends the cookies and therefore user and web sites put an implicit trust on the browser for authorization. An attacker can misuse this trust and make a requests to the site on behalf of the user by embedding links inside the href and src attribute of tags such as link and iframe in third-party site pages that an attacker controls. With this, an attacker can trick an unsuspecting user to load this third party site page in the browser while the user still has authorization to the site that the attacker intends to exploit. Set session cookies with the Strict value for the SameSite attribute, which restricts the browser to append cookies only to requests that are either top level navigation or originate from the same site. Requests that originate from third-party site via links in various tags such as iframe, img, and form do not have these cookies and therefore prevent the site from taking action that the user might not have authorized. Cookie should be set with SameSite=Strict. Following cookies used insecure flag value: sid=e7cd0b20-a488-42dc-9c32-d09742142982; Path=/; HttpOnly; SameSite=lax
Inspect the highlighted cookie value in the HTTP response in the vulnerable session. The cookie is missing the SameSite attribute with strict value. Please note that this check depends on Session Token Discovery logic to identify session cookies. It is possible that the identified cookie does not represent a session token. Additional verification might be required to confirm that the identified cookie does contain a session token.

解决方案

!!! 2022年2月8日11:26:25 !!!
经过部署实际测试，在使用nginx作为代理的前提下，在shiro中重复设置sameSite，会导致不发送cookie，所以如果使用了nginx就在nginx配置不要重复在shiro中配置。

nginx
在http下添加 SameSite=Strict是重点！
add_header Set-Cookie “Path=/; HttpOnly; Secure; SameSite=Strict”;
例如：

http{
    add_header Set-Cookie "Path=/; HttpOnly; Secure; SameSite=Strict";
}

shiro
在bean的name为sessionIdCookie和rememberMeCookie下增加
cookie.setSecure(true);
例如：

@Bean(name = "sessionIdCookie")
public SimpleCookie getSessionIdCookie() {
    SimpleCookie cookie = new SimpleCookie("sid");
    cookie.setHttpOnly(true);
    cookie.setSecure(true);
    cookie.setSameSite(Cookie.SameSiteOptions.STRICT);//加入这句
    return cookie;
}

@Bean(name = "rememberMeCookie")
public SimpleCookie getRememberMeCookie() {
    SimpleCookie cookie = new SimpleCookie("rememberMe");
    cookie.setHttpOnly(true);
    cookie.setSecure(true);
    cookie.setSameSite(Cookie.SameSiteOptions.STRICT);//加入这句
    return simpleCookie;
}