Enhancing Cookie Security in Frappe Core

Frappe Framework
,
1

Hi Frappe Community,

During a recent security review, the issue of Missing Cookie Attributes was flagged. Here are the details and feedback received:

Current Status:

  • Cookies generated by Frappe already include essential attributes to safeguard against cookie-based attacks.
  • While some attributes like Secure and HttpOnly might not always be explicitly visible, Frappe’s core functionality incorporates built-in protections via the Cookies Manager Class.
  • Further direct configuration of cookies is managed within the Frappe core and not customizable externally.

Feedback:

  1. Penetration Tester Recommendation:
  • Explicitly enable the Secure and HttpOnly flags for all core cookies to enhance security further.
  1. Faircode Comment:
  • These attributes are already handled by the Cookies Manager Class in Frappe core, implying they are included by default.
  1. Livelawbazar Feedback (30-11-24):
  • Suggested creating a ticket for the core team to evaluate and confirm this implementation for transparency and thoroughness.

Proposal:

  • Core Team Confirmation: Can the community or the Frappe core team confirm if all cookies in Frappe are consistently configured with Secure and HttpOnly flags across various deployment scenarios?
  • Documentation Update: If these attributes are already enforced, updating the documentation to explicitly mention this could address concerns and provide clarity to users and auditors.

Would it be appropriate to create a ticket for this topic, or are there other considerations we should be aware of? Your guidance would be invaluable.

Best regards,
Nakul P Kumar
Faircode Infotech Pvt. Ltd.

2

Hello,

Do check if this answers your queries: Security FAQs