Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

Could you suggest if there is any reason to compare cookie value domain, path, etc with web "location.href" and so on? I mean - on the client side.

share|improve this question
2  
What are you trying to do? – Polynomial Jul 16 '12 at 20:35
I'm trying to build browser pluging to detect if there is any webpage which use cookies in wrong way. – Holy Sync Jul 16 '12 at 20:44
1  
Not clear enough what you are trying to do. Are you concerned about the same origin policy? – Kapish M Jul 17 '12 at 1:06
Yes, same origin policy but also to check and log if the cookies on current site use cookies properties in most secure way and if not - to let user know about it. – Holy Sync Jul 17 '12 at 7:17

1 Answer

up vote 1 down vote

No. I don't know of any reason to perform that sort of check in a browser plug-in. Web browsers will already perform same-origin checks for you. But then, your question was pretty vague, so it's hard to know what exactly you might have in mind.

Generally speaking, I prefer to start by asking: What problem am I trying to solve? Once you know what problem you're trying to solve, then you can start to talk about technical measures that might help.

share|improve this answer
I was wandering about the example: One browser with two tab. Both have the same website but different pages. What I didn't know was: how to detect which page changed the cookie. After reading your answer I realized - I should use just one tab during the test ;) Sometimes the simplest questions are the toughest. :) Thanks again! – Holy Sync Jul 18 '12 at 12:22
Sorry for late reply. I wish to verify if the domain and path has not been set too loosely: owasp.org/index.php/… – Holy Sync Jul 21 '12 at 10:00
@HolySync, I think there may have been some miscommunication or confusion here. (That would be understandable, as that OWASP page you linked to is not very clearly written.) The OWASP page is talking about suggestions for testing a web application to see if it is using cookies in a safe way. (It is not about testing whether the browser uses the same-origin policy correctly. It is not about helping users of the web site: it is aimed at developers or pentesters.) For more on that, I suggest you start by reading about security testing of web applications. Then, ask a more focused question. – D.W. Jul 22 '12 at 22:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.