guest@websec ~ % man 12-transport-cookies-third-party
12 · Transport, Cookies and Third-Party Scripts
Browser-side hardening from Mozilla's checklist: HTTPS, cookies, and not trusting CDNs blindly.
12.1 TLS everywhere
HTTPS for every site, even "static" ones. Plain HTTP pages can be read or changed on the way.
- Use Mozilla's SSL config generator; "Intermediate" suits most sites.
- Auto-renew certificates.
- Test with SSL Labs after changes.
Redirects that keep HSTS working
Go HTTP → HTTPS on the same host first, then to www, so HSTS sticks. APIs: just turn HTTP off.
Mixed content
One http:// script on an HTTPS page undoes it. Load everything over HTTPS.
force_ssl covers redirects and HSTS. Certificates and TLS live at the proxy, not in Rails.12.2 Cookies: attributes and prefixes
Lock cookies down as tight as possible:
| attribute | what it does | recommendation |
|---|---|---|
Secure | only sent over HTTPS | always |
HttpOnly | invisible to JavaScript (document.cookie) | always, unless your JS truly needs to read it |
SameSite | Strict: never sent cross-site · Lax: only on top-level GET navigation · None: always (requires Secure) | Lax or Strict |
Domain | omitted = this exact host only; Domain=example.com = every subdomain too | omit it unless you need sharing |
Path | limits which paths receive it (weak isolation) | / or narrower |
Expires/Max-Age | persistence; without it, a session cookie | short for sessions |
__Host- prefix | browser rejects the cookie unless Secure, Path=/ and no Domain | best for session cookies |
__Secure- prefix | browser rejects the cookie unless Secure | for cookies that need a Domain |
Why prefixes? Without them, a forgotten subdomain an attacker takes over can overwrite your cookies. __Host- cookies can only come from your exact host.
header
review
force_ssl is on. Rename the key to __Host-myapp_session for the prefix.# config/initializers/session_store.rb Rails.application.config.session_store :cookie_store, key: "__Host-myapp_session" # your own cookies (string key: the prefix contains "-") cookies.encrypted["__Host-prefs"] = { value: { theme: "dark" }, httponly: true, secure: true, same_site: :strict, expires: 30.days }
12.3 Third-party scripts and Subresource Integrity (SRI)
Every CDN script runs with full access to our page. If the CDN gets hacked, so do we. In 2024, polyfill.io changed owners and started serving malware to more than 100,000 sites.
SRI pins a script to its hash. If the file changes, the browser won't run it.
The page pinned the library when it was added. Then someone modifies the file on the CDN.
- Self-host scripts where you can.
- Pin versions and add SRI for CDNs.
- Limit script sources with CSP.
- Delete scripts nobody uses.
integrity: and crossorigin:.12.4 robots.txt is not a security control
It's public, and attackers read it first. Listing secret paths there just advertises them. Use real auth.