Mentat

FLAB Pentest 2022-03 no. 38

Rajmund Hruska wrote in #note-2:

I see a couple of options here:
1. Only set session cookie as secure using Flask configuration (https://stackoverflow.com/questions/45218195/set-secure-attribute-for-flask-cookies)
2. Set all cookies as secure in the code (https://stackoverflow.com/questions/45218195/set-secure-attribute-for-flask-cookies)
3. Set all cookies as secure by using apache2 configuration (https://geekflare.com/httponly-secure-cookie-apache/)

I guess the best option is the third one (maybe together with the first one, just to be sure). What do you think Pavel Kácha?

I think (1) or (2) are not simply combinable with (3). (3) is simple string replacement, which in combination with (1) or (2) might end up as Cookie: name=value; Secure; Secure. Or would need some more elaborate regex love. I'd go for (1), which is still overridable for debugging purposes, like running Mentat under internal Flask webserver (if we ever alow this).

Rajmund Hruska wrote in #note-4:

Pavel Kácha wrote in #note-3:

Rajmund Hruska wrote in #note-2:

I see a couple of options here:
1. Only set session cookie as secure using Flask configuration (https://stackoverflow.com/questions/45218195/set-secure-attribute-for-flask-cookies)
2. Set all cookies as secure in the code (https://stackoverflow.com/questions/45218195/set-secure-attribute-for-flask-cookies)
3. Set all cookies as secure by using apache2 configuration (https://geekflare.com/httponly-secure-cookie-apache/)

I guess the best option is the third one (maybe together with the first one, just to be sure). What do you think Pavel Kácha?

I think (1) or (2) are not simply combinable with (3). (3) is simple string replacement, which in combination with (1) or (2) might end up as Cookie: name=value; Secure; Secure. Or would need some more elaborate regex love. I'd go for (1), which is still overridable for debugging purposes, like running Mentat under internal Flask webserver (if we ever alow this).

(1) will only mark session cookies as Secure. Is that OK? I didn't find any other not secure cookies on mentat-hub, but on mentat-alt there is a fldt cookie, which I guess is the Flask Development Toolbar cookie.

I overlooked, that (1) only concerns session cookie - however we in fact have ONLY session cookie. So I'd go for (1), as config value is easily changeable for developer if he wants to run some fancy environment.

An interesting tool regarding Flask cookie security: https://github.com/Paradoxis/Flask-Unsign