How does nosurf OTP protect against BREACH? about nosurf HOT 5 CLOSED

@elithrar basically nailed it.

Also, why isn't the cookie httpOnly?

I think I simply did not think of doing this initially. And I do not think we should change this now, as it could break compatibility with some more peculiar setups. It is trivial to enable HttpOnly using SetBaseCookie.

from nosurf.

from nosurf.

Thanks, I think I realized my mistake. My understanding was that the cookie value was changed in every server response (so I thought the token would always be unique), however, that does not seem to be the case.

The cookie remains the same for the length of the session (unless changed by manually calling RegenerateToken()). This means that the token sent in the body of the request must change every response so the idea of a OTP makes sense to prevent

1. the cookie and token from matching
2. the token from ever matching a previous response

Is this correct or are their other ways the cookie can change?

Also, why isn't the cookie httpOnly?

from nosurf.

from nosurf.

Perhaps my breakdown would make a good PR or wiki page as this protection was not explained without a dive through the codebase. Any preference?

from nosurf.