Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When you access a website, lynx provide the option to reject a cookie, what's the point of doing so?

All I thought about is that if you don't accept a cookie, you cookie won't be stolen during a XSS attack, is that everything?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

Cookies can be used to keep you logged in to a website, track your browsing history, log your activity and preferences on a website, and some other things. Rejecting cookies prevents this information from being tracked and easily available to the site owner or third-party affiliates. It will also, of course, prevent attackers from accessing or abusing the data through a number of means such as XSS, CRSF, DNS cache poisoning, traffic sniffing, local system exploitation, etc.

I suggest you read more about HTTP Cookies on Wikipedia, and search the web for further details as well. The following sections of the Wiki entry will probably be of particular interest to you:

There are some down-sides to rejecting some cookies.

  • Your authentication to a website will not persist across sessions - you will have to log in again every visit.
  • Your preferences on a website may not be saved, or may not be available until you login.
  • You may not be able to use a shopping cart on e-commerce websites.
  • Other site features that rely on cookies will not function.

Just like any security measure, the choice of allowing or rejecting cookies for any site, or for third-party hosts, comes down to how you want to balance security vs. usability.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.