Does https connection secure cookies and prevents XSS attacks. I have a simple blog that allows users to enter JavaScript code as an input. I want to allow Javascript input by the user while still preventing XSS attacks and cookie stealing. Does https help secure cookies. I only found few sites that talks about this and still a bit unclear.

Does https connection secure cookies and prevents XSS attacks. I have a simple blog that allows users to enter JavaScript code as an input. I want to allow Javascript input by the user while still preventing XSS attacks and cookie stealing. Does https help secure cookies. I only found few sites that talks about this and still a bit unclear.

• php
• javascript
• security
• https
• xss

• HTTPS in itself doesn't prevent XSS. – Steven Commented Jun 30, 2011 at 5:34
• 1 Allowing users to input Javascript is extremely dangerous. It is very difficult to prevent a malicious user doing some very nasty things to your other users. – Cameron Skinner Commented Jun 30, 2011 at 5:57
• @Cameron - whether it is dangerous or not is irrelevant. Given that browsers support the javascript pseudo–protocol and add-ons like Greasemonkey and Firebug let users run scripts in pages, it is impossible to stop users from running whatever script they want in the pages in their browser or any other user agent. – RobG Commented Jun 30, 2011 at 6:55
• @Keoki - I think the question is how to write safe code. As a developer, i would search here in stackoverflow. – martinstoeckli Commented Jun 30, 2011 at 8:14
• @RobG: The point was that if I allow user A to entry arbitrary javascript and my server serves it to user B then that is a great avenue of attack for malicious user A. The point is not that any one user is running Javascript; it's the potential for users to cause problems for each other that's the trouble. – Cameron Skinner Commented Jun 30, 2011 at 23:01

5 Answers 5

HTTPS can prevent a man-in-the-middle attack, not XSS. Unfortunately the session cookie is not secure with this alone, one can request a page with HTTP and then the same cookie will be sent unprotected.

To ensure that the session cookie is sent only on HTTPS connections, you can use the function session_set_cookie_params() before starting the session:

session_set_cookie_params(0, '/', '', true, true);
session_start();

Note the first true, it means that the cookie will be sent only to HTTPS pages. The second true tells the browser, that JavaScript must not access the session cookie, it depends on the browser if that is done correctly.

Another good way to make your site safer is, to use the session cookie only for maintaining the session, and using a second cookie to take care of the authentication. I can provide an example if you are interested.

The HTTP protocol (HTTPS or HTTP) does not help with XSS or really have any relation. You'll need to add preventative measures and be careful where you output the javascript to the client.

Once you've allowed someone to dynamically store and execute arbitrary JavaScript on your site, they have access to a lot of stuff you would want them to leave alone. At a minimum, they can hijack your PHP Session ID (they'll have access to your cookies, after all) and then use Ajax to forward it to some remote server. Once they have that, they can then do all sorts of crap to your users.

If you have to let them add their own JavaScript, I would remend that you specifically disable all Ajax functionality (XMLHTTPRequest = function(){} prevents all Ajax pretty easily on most browsers, but you might need to look into what IE needs (I don't know what ActiveXObject = function(){} will do...)). Unfortunately, you can't prevent access to cookies if you have any expectation of using them (i.e. if you have a session), so you will need to find some other workaround.

If you want users to be able to input JavaScript code, but not have it parsed, run it through htmlspecialchars. If you want them to be able to execute code, then no, HTTPS won't help, and you're going to need to parse the code and remove anything bad from it.

You can use a Web Application Firewall to scan and block XSS, including in cookies though the latter can cause false positives https://medium./p/5d4b1d33219a/edit