Bug 1368525 - Secure cookie sent over plain HTTP when insecureEdgeTerminationPolicy allows both TLS and non-TLS
Summary: Secure cookie sent over plain HTTP when insecureEdgeTerminationPolicy allows ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Routing
Version: 3.2.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: Maru Newby
QA Contact: zhaozhanqi
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-19 16:12 UTC by Josep 'Pep' Turro Mauri
Modified: 2017-03-08 18:26 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: When an edge-terminated Route had insecureEdgeTerminationPolicy set to Allow — meaning that the Route could be accessed by both http and https — the inserted session cookie was always flagged as Secure. Consequence: When a client connected over http the secure cookie would be dropped, breaking session persistence. Fix: Cookies for edge-terminated routes that allow insecure connections are set to be non-secure. Result: Session persistence for such routes is maintained.
Clone Of:
Environment:
Last Closed: 2016-09-27 09:45:14 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:1933 normal SHIPPED_LIVE Red Hat OpenShift Container Platform 3.3 Release Advisory 2016-09-27 13:24:36 UTC
Origin (Github) 10544 None None None 2016-08-19 17:57:14 UTC

Description Josep 'Pep' Turro Mauri 2016-08-19 16:12:33 UTC
Description of problem:
When a Route is defined with TLS edge termination and insecureEdgeTerminationPolicy is set to Allow —meaning that the Route can be accessed both via http and https— the inserted session cookie is always flagged as Secure.

When connecting via HTTP this means that the client will drop it, breaking session persistence.

Version-Release number of selected component (if applicable):

openshift3/ose-haproxy-router:v3.2.1.9

How reproducible:
Always

Steps to Reproduce:
1. Create a Route with tls.termination=edge and tls.insecureEdgeTerminationPolicy=Allow
2. Access the route over plain HTTP

Actual results:

the session cookie is flagged as Secure both when accessing over HTTP and HTTPS

$ curl -si http://nodejs-mongodb-example-wonderland.test.sod.io/ | grep Set-Cookie
Set-Cookie: d4590b192758b8d77238014a0bf62c56=d681e9e03fd59798bb181a2d4f554775; path=/; HttpOnly; Secure
$ curl -ski https://nodejs-mongodb-example-wonderland.test.sod.io/ | grep Set-Cookie
Set-Cookie: d4590b192758b8d77238014a0bf62c56=d681e9e03fd59798bb181a2d4f554775; path=/; HttpOnly; Secure

Expected results:

the cookie should not be marked as Secure when the route is accessed over plain HTTP

Comment 4 Meng Bo 2016-08-23 08:13:11 UTC
Checked on OSE build v3.3.0.24

Issue has been fixed.

[user1@ose-master ~]$ oc get route
NAME                 HOST/PORT               PATH      SERVICES           PORT      TERMINATION
secured-edge-route   test-edge.example.com             service-unsecure   <all>     edge/Allow
[user1@ose-master ~]$ curl --resolve test-edge.example.com:443:10.66.141.94 https://test-edge.example.com/ -ksi | grep -i cookie
Set-Cookie: 856b4156ac0b95c408838f12ef7f9606=d32a4671f8f41f0d1a12fb20d80891a2; path=/; HttpOnly
[user1@ose-master ~]$ curl --resolve test-edge.example.com:80:10.66.141.94 http://test-edge.example.com/ -ksi | grep -i cookie
Set-Cookie: 856b4156ac0b95c408838f12ef7f9606=558525a7a02b24756fb18f087aab7be6; path=/; HttpOnly

Comment 6 errata-xmlrpc 2016-09-27 09:45:14 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1933


Note You need to log in before you can comment on or make changes to this bug.