Beware Cookie Sharing in Cross-Zone Scenarios

re: Beware Cookie Sharing in Cross-Zone Scenarios

Brian J. Sayatovic — Wed, 09 May 2012 18:52:53 GMT

I think I encountered an even stranger case of this. I have a Silverlight application that runs in the browser. The HTML page hosting the <object/> tag, and the XAP file it points to, is all delivered via http://launch.mydomain.com. Once launched, the Silverlight application uses WCF to httpS://service.mydomain.com except for displaying PDF documents which is does by popping a window open to httpS://service.mydomain.com with a GET request. Now the cookie in question is delivered in the HTTP response header to one of the WCF calls to httpS://service.mydomain.com. Depending on whether the page that delivered hosted the <object/> tag in the first place is in the same security zone affects the delivery of the cookie. On the one hand, I get it. But on the other hand, the cookie was both delivered and attempting to be re-sent to one zone -- the zone of httpS://service.mydomain.com. But, in IE9 at least, the zone of the page hosting the Silverlight control still impacted the function.

re: Beware Cookie Sharing in Cross-Zone Scenarios

Vinod — Mon, 05 Mar 2012 20:42:58 GMT

Will wininet use the cookie in the request when i have a Referrer set in a different domain that is loading in Internet zone?

Sample request:

- Http: Request, GET http://intranetsite

Command: GET

+ URI: http://intranetsite

Accept: */*

Referer: http://internet.site.com

Cookie: cookieset

Does Referrer really matter to set a cookie?

From my analysis, i see the cookie is used when either protected mode is turned on/off in both the zones.

Thanks in advance

re: Beware Cookie Sharing in Cross-Zone Scenarios

Aaron Margosis — Mon, 26 Sep 2011 04:24:14 GMT

Re this statement: "users may view all of their Zone assignments by clicking Tools > Internet Options > Security > Trusted > Sites…." It becomes more complicated if there are group policies dictating that only machine settings are used, and/or group policy dictates one or more site-to-zone-assignment lists. See

blogs.technet.com/.../internet-explorer-s-explicit-security-zone-mappings.aspx

and

blogs.technet.com/.../iezoneanalyzer-v3-5-with-zone-map-viewer.aspx

re: Beware Cookie Sharing in Cross-Zone Scenarios

EricLaw [MSFT] — Fri, 22 Jul 2011 13:44:34 GMT

@Anshu: If the pages are in the same zone (as described in this article), then yes, the insecure cookie will be sent to the secure subdomain by IE only. See Q3 at blogs.msdn.com/.../wininet-ie-cookie-internals-faq.aspx

re: Beware Cookie Sharing in Cross-Zone Scenarios

Anshu — Fri, 22 Jul 2011 09:07:38 GMT

I want to know if we redirect from HTTP to HTTPS, should IE send the session cookie with HTTPS request?

Host: mpcb.mu (for HTTP)
Host: secured.mpcb.mu (for HTTPS)

Here are the cookie attributes set from the server:

Set-cookie: JSESSIONID=4E8CEB2926EFD; Path=/ ; HttpOnly