Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
1

What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't serve up cookies from another domain to my website if it asks for them?

share|improve this question

2 Answers

up vote 6 down vote accepted

In short, guarantee that cookies from site A won't be read by site B is provided by so called Same Origin Policy (SOP). This is browser security implementation. Sure, if there is a place for code injection (like XSS), attacker can steal your cookies, but that's another scope - in that case client "allows" (but user is unaware) to retrieve cookies by third-party.

Additionally, I highly recommend to read Michal Zalewski's browser security book, or, at least chapter of it: http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookies. Also, nice post about cookies is again from himself: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design.html.

Some good, related to this question links from here: How can I check that my cookies are only send over encrypted https and not http? and Are browser still vulnerable to Cross-Site Cooking ?.

share|improve this answer
What if the browser doesn't implement SOP? (Also, you misspelled "third".) – Moshe Nov 20 '10 at 23:30
1  
@Moshe, thanks, fixed. I would say that browser without SOP or it's any analogue security scope implementation is a bicycle without wheels. – anonymous Nov 20 '10 at 23:33
1  
@Ams, actually it would be more like a bicycle without brakes. And all the current (popular) browsers do implement it, but of course there could always be bugs. – AviD♦ Nov 20 '10 at 23:41
@AviD, right, that sounds better :) – anonymous Nov 20 '10 at 23:59
up vote 0 down vote

In addition to SOP cookies can be marked as HTTP Only which means Javascript can't access them, thus protecting them against XSS attacks and can also be marked as Secure which means they're only served over an HTTPS connection, protecting them from sniffing like Firesheep.

Of course all this relies on the browser getting it right, and in some cases supporting it. Safari for example didn't support HTTP Only cookies in its first couple of versions.

share|improve this answer
I think "In addition to SOP" is not suitable wording. Yes, those measures are provided by browser, but one is a scope integrity, others are route and data integrity. I suppose, author asked only about SOP. But addition is correct, it is just important to distinguish the levels of those security implementations. – anonymous Nov 20 '10 at 23:45
2  
Well the question starts with "What protects cookies from being stolen?" So while SOP is mentioned specifically, HttpOnly/Secure does add to the first question – blowdart Nov 21 '10 at 5:08
1  
"cookies can be marked as HTTP Only which means Javascript can't access them, thus protecting them against XSS attacks" Not really. (Actually, not at all.) HTTPOnly only prevents read access to the cookie in JS. – curiousguy Nov 13 '11 at 1:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.