RequestPolicy/requestpolicy — Issue #90: Passing of Cookies & Authentication Headers to Cross-site Requests
Author: jsamuel
Created: 2011-12-22 05:02:23+00:00
State: open
Labels: extension

When sites are browsed that have been whitelisted, I believe RequestPolicy will permit the passing of cookies and authentication headers to the destination site. That is as it should be.

However, there may be cases where one does not wish such cookie/authentication headers to be forwarded. Such situations would arise particularly for sites whitelisted in the origins or destinations sections, where the cross-site destination or originating requests, respectively, are unknown.

For example,
I've whitelisted the destination site maps.google.com. I browse to my favorite store, Harrods.com, and login to my account via HTTPS. I then decide to physically visit Harrods, so I check the 'How to get to Harrods' page. Whilst still logged into Harrods.com, the page displays different modes of transportation as well as a map from maps.google.com.

Now if maps.google.com were malicious (who knows with Google), they could retrieve my Harrods.com session cookie and other encoded credentials, courtesy of Firefox.

This problem is even more of a threat when the "Temporarily allow all requests" is selected, when both the originating and destination sites are typically random sites whilst generally browsing the internet for information. Also with the increasing prevalence of AJAX and mashups, a typical user is typically unaware of the cross-site requests that are taking place.

I therefore advocate RequestPolicy to have the option to specify whether cookies and/or authentication headers are to be stripped from cross-site requests for the aforementioned.

For whitelisted sites listed in the origins-to-destinations section, the passing of cookies and authentication headers, would not be a cause for concern, as both originating and destination site pairs have been explicitly specified by the user.