Name the auth cookie __Host- where it can be

Without the prefix any host under the same domain could set a cgitauth
cookie of its own, signing a visitor in as someone else or out.

2 files changed, 20 insertions, 4 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.luaindex 2ef2328..f5d250c 100644--- a/custom/extensions/auth-file.lua+++ b/custom/extensions/auth-file.lua@@ -101,6 +101,14 @@ local cookie_insecure = false -- the password's length, and one longer than this is turned down unchecked. local max_password_bytes = 256 +-- A browser accepts a cookie named __Host- only when it is Secure, covers the+-- whole host and was set by this host, so no sibling subdomain can plant a+-- session in its place. Either cookie setting above can rule that out.+local session_cookie = cookie_name+if not cookie_insecure and cookie_path == "/" then+	session_cookie = "__Host-" .. cookie_name+end+ -- One request reaches this script as an open, a write and a close, so what the -- open decodes is kept here for the calls that follow. local action, http, cgit, post@@ -502,7 +510,7 @@ function authenticate_post() 	end  	-- A failed login answers with an empty session, which clears the cookie.-	set_cookie(cookie_name, session)+	set_cookie(session_cookie, session)  	html("\n") 	return 0@@ -517,7 +525,7 @@ function authenticate_cookie() 		return 1 	end -	local cookie = get_cookie(http["cookie"], cookie_name)+	local cookie = get_cookie(http["cookie"], session_cookie) 	local username = validate_value("username", cookie, account_hash) 	if username == nil or not accepted_users[username:lower()] then 		return 0
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 2ef2328..f5d250c 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -101,6 +101,14 @@ local cookie_insecure = false
 -- the password's length, and one longer than this is turned down unchecked.
 local max_password_bytes = 256
 
+-- A browser accepts a cookie named __Host- only when it is Secure, covers the
+-- whole host and was set by this host, so no sibling subdomain can plant a
+-- session in its place. Either cookie setting above can rule that out.
+local session_cookie = cookie_name
+if not cookie_insecure and cookie_path == "/" then
+	session_cookie = "__Host-" .. cookie_name
+end
+
 -- One request reaches this script as an open, a write and a close, so what the
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
@@ -502,7 +510,7 @@ function authenticate_post()
 	end
 
 	-- A failed login answers with an empty session, which clears the cookie.
-	set_cookie(cookie_name, session)
+	set_cookie(session_cookie, session)
 
 	html("\n")
 	return 0
@@ -517,7 +525,7 @@ function authenticate_cookie()
 		return 1
 	end
 
-	local cookie = get_cookie(http["cookie"], cookie_name)
+	local cookie = get_cookie(http["cookie"], session_cookie)
 	local username = validate_value("username", cookie, account_hash)
 	if username == nil or not accepted_users[username:lower()] then
 		return 0
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.luaindex bce2472..ae21c7a 100644--- a/custom/extensions/auth-inline.lua+++ b/custom/extensions/auth-inline.lua@@ -100,6 +100,14 @@ local cookie_insecure = false -- the password's length, and one longer than this is turned down unchecked. local max_password_bytes = 256 +-- A browser accepts a cookie named __Host- only when it is Secure, covers the+-- whole host and was set by this host, so no sibling subdomain can plant a+-- session in its place. Either cookie setting above can rule that out.+local session_cookie = cookie_name+if not cookie_insecure and cookie_path == "/" then+	session_cookie = "__Host-" .. cookie_name+end+ -- One request reaches this script as an open, a write and a close, so what the -- open decodes is kept here for the calls that follow. local action, http, cgit, post@@ -463,7 +471,7 @@ function authenticate_post() 	end  	-- A failed login answers with an empty session, which clears the cookie.-	set_cookie(cookie_name, session)+	set_cookie(session_cookie, session)  	html("\n") 	return 0@@ -478,7 +486,7 @@ function authenticate_cookie() 		return 1 	end -	local cookie = get_cookie(http["cookie"], cookie_name)+	local cookie = get_cookie(http["cookie"], session_cookie) 	local username = validate_value("username", cookie, account_hash) 	if username == nil or not accepted_users[username:lower()] then 		return 0
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index bce2472..ae21c7a 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -100,6 +100,14 @@ local cookie_insecure = false
 -- the password's length, and one longer than this is turned down unchecked.
 local max_password_bytes = 256
 
+-- A browser accepts a cookie named __Host- only when it is Secure, covers the
+-- whole host and was set by this host, so no sibling subdomain can plant a
+-- session in its place. Either cookie setting above can rule that out.
+local session_cookie = cookie_name
+if not cookie_insecure and cookie_path == "/" then
+	session_cookie = "__Host-" .. cookie_name
+end
+
 -- One request reaches this script as an open, a write and a close, so what the
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
@@ -463,7 +471,7 @@ function authenticate_post()
 	end
 
 	-- A failed login answers with an empty session, which clears the cookie.
-	set_cookie(cookie_name, session)
+	set_cookie(session_cookie, session)
 
 	html("\n")
 	return 0
@@ -478,7 +486,7 @@ function authenticate_cookie()
 		return 1
 	end
 
-	local cookie = get_cookie(http["cookie"], cookie_name)
+	local cookie = get_cookie(http["cookie"], session_cookie)
 	local username = validate_value("username", cookie, account_hash)
 	if username == nil or not accepted_users[username:lower()] then
 		return 0