A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

0
votes
2answers
36 views

How session cookies work? [on hold]

I want to know the basic working of session cookies. When i tried googling, most of the results came were based on any programming language. I am not good at coding. So it will be helpful if someone ...
0
votes
2answers
116 views

What is actually the purpose of encrypting the values in a cookie?

I was researching on internet security. When I reached at section Cookies, I happened to read that the values inside a cookie are generally stored only after encrypting them. But an encryption can be ...
-1
votes
1answer
35 views

What is cookie reverse engineering? [on hold]

I want to know what is this cookie reverse engineering and how to do this is simple words. Thanks in advance.
2
votes
1answer
43 views

Conversant, CNAME, Cookies, and PCI complaince

We have been asked to evaluate Conversant Tracking. http://www.conversantmedia.com/solutions/enterprise-solutions From what I can tell its pretty straight forward tracking, like google re-marketing, ...
2
votes
2answers
119 views

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

I'm writing a web app that already uses TLS encrypted connections (HTTPS), Secure; HttpOnly session cookie, HMAC-SHA1 CSRF token, requires correct Referer header to avoid Login CSRF and changes ...
1
vote
2answers
40 views

How to Secure Exchange 2010 cookie?

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
1
vote
1answer
52 views

Logging in users automatically on a website

I'm making a website that has an extended forum feature, where users can login, post comments, etc. I'm making the feature where the website stores cookies in your computer so the next time you visit ...
2
votes
1answer
68 views

Is this a safe way to identify users connecting to a chat server?

Before I start, all information will go over HTTPS. So, my website is basically like a forum with the authentication part finished and working. This forum has a real time chat application that sends ...
0
votes
0answers
35 views

How to disable x-oracle-dms-ecid cookie

During a security audit, our cliente found that we are sending to the cliente a cookie called 'x-oracle-dms-ecid'. They asked to disable it or change its name. We have been reading all the Oracle ...
0
votes
1answer
104 views

How to delete YouTube zombie cookies

Some days ago I noticed that YouTube knows the videos I watched even though I deleted my cookies. I also was not using a YouTube-account. When I noticed I used IE 11. After some research I found out ...
1
vote
2answers
75 views

Can you use https only for cookies and not the html?

I have a few questions, all relating to the title. 1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http? 2) Does SE do this / do many ...
2
votes
3answers
63 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
1
vote
1answer
53 views

Would it be possible to use cookie to store SSL Client Certificate?

Lately, I was reading that article about SSL client certificate. Why is nobody using SSL Client Certificate? The answer was to that question was : In the current state, this excellent idea is ...
0
votes
1answer
52 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
0
votes
2answers
70 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
1
vote
1answer
401 views

Why use an authentication token instead of the username/password per request?

The author of http://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
0
votes
1answer
62 views

How do websites tracker cookies and beacon work?

Could someone please enlighten me, either on a technical level or high level if that detail is not feasible, on how tracker cookies and beacons work. Particularly, how information on my browsing ...
3
votes
1answer
154 views

How is YouTube able to identify anonymous users?

A few days ago I was searching YouTube and I noticed an "outlier" video poped up in the suggestions list. This video had nothing to do with the topic being searched, but instead it was based on a ...
0
votes
2answers
47 views

What conditions allow an attacker to write a cookie?

Some CSRF protection mechanisms are vulnerable to attackers who can write cookies. Others are not but incur extra complexity or computational cost. Help me understand the cost/benefit. What ...
1
vote
0answers
85 views

Accessing Chrome and Gmail on a stolen drive

I was trying to search for this, but could not find the answer anywhere - apology in advance if already answered. I have a Linux desktop installed on a thumb drive, which I keep in my pocket. This ...
1
vote
2answers
119 views

Is it safe to skip CSRF checks for non-browsers?

I was in the middle of implementing a CSRF protection mechanism for my server when I realized that this attack only really affects web browsers. It got me wondering: why should I bother ...
-1
votes
1answer
194 views

My cookies have been stolen. What to do?

About a month and a half ago I got infected by a virus called MSIL.Bladabindi. I noticed the virus quite soon because google notified me that someone from Turkey tried to access my account (I'm in ...
0
votes
2answers
72 views

Javascript injection via document.cookie possible?

Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this ...
0
votes
0answers
76 views

CAS protection against CSRF attacks

A website based on Apache Struts uses central authentication service (cas) for login. I'd like to know if additional csrf protection needs to be provided with Struts in case cas doesn't provide that. ...
0
votes
0answers
42 views

Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?

I won't really go into details of how cookie tossing and cookie overflow attacks work, because this answer explains it perfectly. This post on github explains some mitigation strategies, but does not ...
2
votes
2answers
329 views

Double Submit Cookies vulnerabilities

Is the Double Submit Cookies mechanism vulnerable anything other than XSS and sub-domain attacks? All CSRF protection mechanisms are vulnerable to XSS, so that's nothing new. I'm just wondering if I ...
0
votes
0answers
41 views

Can one scan multiple websites for tracking cookies and beacons?

Do you know of any tools or techniques that allow one to scan multiple sites for the use of tracking cookies, beacons, web bugs, or offsite javascript includes? As far as I can tell, major web ...
3
votes
2answers
197 views

Web security - use of cookie in https

I am taking a web security class and was told by the instructor that most of the websites today use https for authentication and then use a cookie (authentication token) in plain text to keep track of ...
2
votes
1answer
90 views

Does using token-based auth make CSRF checks on login unnecessary?

Based on my understanding, avoiding the use of cookies as an authentication mechanism prevents CSRF vulnerabilities entirely (namely token based authentication in an SPA), when authenticated. Does ...
6
votes
3answers
1k views

Why can't we do MiTM attacks when using secure connection

I have this silly question that is bothering me. When not using secure connection (HTTP for example) cookies can be intercepted and used to connect to the site as if we have the id and password. We ...
5
votes
4answers
681 views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until ...
0
votes
1answer
52 views

Setting a temporary cookie to an invalid value when logout improves security?

When a session is closed, for example, when a timeout triggers or when the user clicks the logout button, the session should be terminated at server side so the session cookie is invalid. I think ...
0
votes
3answers
89 views

Does it have sense a One-Time Session Cookie?

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites. In each request the server sends a ...
3
votes
1answer
117 views

XSS via PDF when Content-Disposition: Inline?

There are kind of two questions here: Is it possible to have XSS in a PDF file when the Content-Disposition: is "inline"? If it is possible, does the pdf get access to the cookies for that domain ...
3
votes
2answers
133 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
-2
votes
2answers
119 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
0
votes
0answers
74 views

Will http only cookie work while using chrome bandwidth saving feature in Android?

I am developing a site which uses http only cookies for authentication. By design[w3 standard] these cookies are XMLHttpObjects and will only be submitted to the domain they originated from to prevent ...
1
vote
1answer
135 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
6
votes
1answer
159 views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § ...
2
votes
1answer
395 views

HeartBleed - how do I invalidate all session cookies?

As part of the Heartbleed event, I have upgraded OpenSSL, reissued and replaced certificates and revoked the old ones and changed passwords however, I am also seeing advice to invalidate all session ...
1
vote
0answers
243 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
1answer
347 views

Hashing the cookie token for persistent login

In a login system I'm doing, I'm using a per-user, per-device randomly generated cookie token. A part of the script looks like this: // Generate current device's token $token = ...
1
vote
0answers
271 views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
0
votes
1answer
84 views

What kind of encoding/hash it is [closed]

I have email which is stored in Cookie : %2FGl%F8%7E%06%F1S%FEF%10%E0T%B3%95%82BK%D9%D3%94%BC%AE%E1 which is sth like this after convert it with this tool : ...
0
votes
1answer
173 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
1
vote
2answers
106 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
0
votes
1answer
96 views

Wouldn't transient cookies for session management increase effectiveness of MITM?

According to wikipedia, a transient cookie (aka session-cookie, in-memory cookie) is forgotten when the user closes the browser. These are also recommended for session cookies by OWASP. I've seen a ...
0
votes
2answers
334 views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
2
votes
2answers
203 views

Bypass cookie validation

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this: ...
3
votes
2answers
80 views

Is it normal for a payment procedure to ask for third party cookies to be turned on?

I was trying to pay for mobile phone credit online from a service provider. I selected the amount to pay and clicked next to continues. The following page asked me to turn on third party cookies if I ...