Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I tried writing a script that would display the contents of a cookie set by another website but it didn't work.

<?php
 echo 'Website cookie is  '.$_COOKIE['locale'];
?>

But I get an undefined index error. Can cookies only be retrieved by the issuing site? I've got the add on Cookie Manager in Firefox opened and each cookie has a site and name. So can a cookie only be viewed if the site requesting it also issued it and (obviously) the right name is given? How is the enforced - are web browsers simply programmed this way or do the cookies have some sort of inbuilt security?

share|improve this question
    
Notice how facebook just logs you in from a cold boot? If I could get the cookie in your browser that facebook.com put there, I could log in as you. Cookies often hold quite valuable information that way, and are as such reasonably well protected. –  lynks Mar 29 '13 at 9:21

2 Answers 2

up vote 4 down vote accepted

Yes, browsers enforce cookie domain scoping. There are a number of rules around when cookies may be sent, but the most basic rule is that cookies are only attached to requests to the same domain from whence they were set.

Additionally, if the cookie has a path attribute it will only be sent with requests that match that path within requests to domain from which they were set, and cookies that are marked with the "secure" flag will only be sent along with requests that are made via HTTPS.

share|improve this answer

Yes, cookies from a site can only be viewed from the same site. This is implemented by browser; it is necessarily implemented by browsers because HTTP is a request-response protocol. When your PHP code runs, it is on the server, because a request from the browser has been received, and your code can only explore what the browser decided to send in its request. When they talk to a server, browsers send known cookie for that server only, and when the server sends back a cookie value to store in the browser, the browser stores it as relevant to that site specifically, and none other.

(There are subtleties with sub-domains but the big picture remains the same: sites cannot see cookies from other sites or store cookies destined to other sites, and this separation is enforced by browsers. For details see the standard.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.