CVE-2012-0053: a quiet reminder that httponly is not absolute
This note looks at CVE-2012-0053, a flaw in Apache HTTP Server that let an oversized request indirectly expose cookie values the httponly flag was supposed to protect.
What httponly is meant to do
Setting the httponly attribute on a cookie tells a compliant browser not to expose that cookie's value to client-side script through document.cookie. It is a defence specifically against session-cookie theft via cross-site scripting: even if an attacker manages to run script in the victim's browser, that script cannot read the protected cookie directly.
Where the flaw sat
The vulnerable versions of Apache responded to certain oversized or malformed requests, including ones with headers larger than its configured limit, with an error page that echoed back the full set of request headers for diagnostic purposes, cookies included. Because that echo happened inside the server's own error-handling response rather than through client-side script reading the cookie, the httponly flag had no bearing on it at all. An attacker able to trigger that error path from a victim's browser could still recover a cookie value they were never supposed to see client-side.
Why this mattered beyond one bug
The flaw is a good illustration of a recurring pattern in web security: a protection implemented at one layer, here the browser's cookie-access rules, can be bypassed entirely by a different layer, here server-side error handling, that was never designed with that protection in mind. Verifying a security control means checking every code path that touches the protected data, not just the one the control was explicitly built to stop.
What changed
The Apache project shipped a fix that stopped echoing full header and cookie content back in diagnostic error pages, closing the exposure path without touching the cookie-handling logic itself, since the cookie handling was never the actual bug. Administrators running affected versions needed only to patch and did not need to change their cookie configuration.
Takeaway for builders
Treat httponly, secure, and SameSite cookie flags as necessary but not sufficient. They stop specific client-side attack paths; they do nothing to stop a server bug that re-exposes the same data through an entirely different channel.
Key takeaways
- CVE-2012-0053 let oversized Apache requests echo cookie values back through an error page, bypassing httponly.
- httponly only blocks client-side script access to a cookie; it has no effect on server-side disclosure bugs.
- The fix targeted the error-handling echo, not the cookie configuration, because that was where the real bug lived.
- Security controls need to be checked against every code path that touches the protected data, not just their intended attack path.
This note has been rewritten and checked for this edition; it is not a copy of the original post.