Does https secure cookies prevent XSS attacks?

Question

Does https connection secure cookies and prevents XSS attacks. I have a simple blog that allows users to enter JavaScript code as an input. I want to allow Javascript input by the user while still preventing XSS attacks and cookie stealing. Does https help secure cookies. I only found few sites that talks about this and still a bit unclear.

Answer 1

HTTPS can prevent a man-in-the-middle attack, not XSS. Unfortunately the session cookie is not secure with this alone, one can request a page with HTTP and then the same cookie will be sent unprotected.

To ensure that the session cookie is sent only on HTTPS connections, you can use the function session_set_cookie_params() before starting the session:

session_set_cookie_params(0, '/', '', true, true);
session_start();

Note the first true, it means that the cookie will be sent only to HTTPS pages. The second true tells the browser, that JavaScript must not access the session cookie, it depends on the browser if that is done correctly.

Another good way to make your site safer is, to use the session cookie only for maintaining the session, and using a second cookie to take care of the authentication. I can provide an example if you are interested.

Answer 2

The HTTP protocol (HTTPS or HTTP) does not help with XSS or really have any relation. You'll need to add preventative measures and be careful where you output the javascript to the client.

Answer 3

Once you've allowed someone to dynamically store and execute arbitrary JavaScript on your site, they have access to a lot of stuff you would want them to leave alone. At a minimum, they can hijack your PHP Session ID (they'll have access to your cookies, after all) and then use Ajax to forward it to some remote server. Once they have that, they can then do all sorts of crap to your users.

If you have to let them add their own JavaScript, I would recommend that you specifically disable all Ajax functionality (XMLHTTPRequest = function(){} prevents all Ajax pretty easily on most browsers, but you might need to look into what IE needs (I don't know what ActiveXObject = function(){} will do...)). Unfortunately, you can't prevent access to cookies if you have any expectation of using them (i.e. if you have a session), so you will need to find some other workaround.

Answer 4

If you want users to be able to input JavaScript code, but not have it parsed, run it through htmlspecialchars. If you want them to be able to execute code, then no, HTTPS won't help, and you're going to need to parse the code and remove anything bad from it.