Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy person quickly) can attacker by man-in-the-middle-attack send me a facebook page in http and see my cookie then use that cookie to use my account?

share|improve this question
up vote 4 down vote accepted

Not speaking for Facebook specifically, but in any decently configured Web server, the cookies sent over HTTPS are marked "secure" and the browser will not send them back to the server if not using HTTPS (from the browser point of view, if the name is the same but not the protocol, then it is not the same server).

Of course, a user who crazily clicks without paying attention... that's the root of all vulnerabilities.

share|improve this answer
but Thomas honestly when you for example surfing on facebook or any site, check address bar for every page ? we are professional and don't check, regular people for sure will not ... the question is if attacker MITM victim and victim have no HTTPSanywhere then why not attacker success ? – pier Oct 19 '12 at 18:08
for example you click on but i inject you which have an inframe of or just http facebook pages directly to you. then your browser send all data to that server over http – pier Oct 19 '12 at 18:16
@pier: in that situation, my browser sees and will NOT send the cookies which have been recorded for, regardless of how much, as a human user, I am convinced to interact with the true Facebook site or not. – Thomas Pornin Oct 19 '12 at 18:19
well if browser see then send data to facebook over http – pier Oct 19 '12 at 19:01
And yet the browser will NOT send to a cookie which has been initially set by The human user may not see the extra 's', but the browser minds it and takes care. – Thomas Pornin Oct 19 '12 at 19:13

No, this is not possible because Facebook uses HTTPS for everything. You can MITM and and no one cares.

Other than an OWASP a9 violation, there are plenty of other vulnerablites that allow you to access a victom's account. XSS, CSRF, Insecure Direct Object Reference, SQL Injection... The list goes on.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.