A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

2
votes
2answers
71 views

Should I regularly erase cookies?

Cookies really do make for a better experience on the web but do they also create a vulnerability? How often should I clean them out and what benefits are gained by doing so?
0
votes
1answer
34 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
2
votes
2answers
75 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
2
votes
1answer
55 views

Logout tied to cookie expiry

I am looking for an event to automatically logout a user from the application. Typically I would do it when an inactive session expires. I was wondering if it is secure to do so using cookies. So here ...
3
votes
1answer
96 views

Session Identification Hashing - How to make it more Secure and Robust

I wrote a PHP class which handles Session and store them in DB instead of normal Files in the server, you can find it on My Session Handler Class In that post a user by name @AnotherGuy has raised ...
5
votes
4answers
620 views

XSS for stealing cookies … not anymore?

The other day I found a XSS vulnerability in a website that a friend told me to Pentest. It was a page from a school that he's managing, so the important thing here is the login credentials == ...
4
votes
2answers
65 views

Securely store session data in cookies

I'm trying to create a stateless application server architecture and I would like to store session data in cookies. All pages using the session would be served over HTTPS. I was planning on using ...
4
votes
1answer
48 views

Ideal time for cookies to expire?

I get that websites that contain confidential personal information (e.g. banking system) have short sessions and expiration time for cookies for obviously reason. But what are the causes for sites, ...
1
vote
2answers
38 views

Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?

There are several uses for a cookie, and I would like to offer some kind of guarantee that a cookie is being used for a specific, limited purpose and scope. In my case, I want to prove that a cookie ...
2
votes
2answers
46 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
4
votes
1answer
59 views

Storing personal information in cookies

I'm trying to do a simple display integration between two websites. One on: domain.com and another on: subdomain.domain.com All I want to do is show a "Hello John, Return to Client Area" ...
1
vote
1answer
69 views

Brute force attack [closed]

I'm trying to make a simple script (brute force attack) on Joomla to try if it works. #! /usr/bin/python import re #regex import urllib import urllib2 x = ...
7
votes
3answers
332 views

Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few ...
0
votes
0answers
551 views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
1
vote
1answer
90 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
3
votes
1answer
42 views

Separate third-party cookies for each website

Instead of blocking third-party cookies (which might be useful), why don't browsers allow them, but keep all cookies separate for each address-bar website? For example, if a third-party website sets ...
3
votes
1answer
54 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
3
votes
1answer
136 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
0
votes
1answer
152 views

Setting the HTTPOnly flag for PHPSESSID cookie [closed]

I am getting this message from my security audit: Cookie name: "PHPSESSID" Cookie domain: "xxx.xxx.xx.xxx" If possible, you should set the HTTPOnly flag for this cookie. How can I set ...
1
vote
1answer
102 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
3
votes
1answer
63 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
18
votes
3answers
3k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
2
votes
2answers
61 views

Is it any more or less secure to delete all my cookies vs. individually logging out?

So I've lost all of my Firefox bookmarks (well not since 3.0) or history (3.5?) or my current session enough times (yeah... this still happens) that I don't leave my precious Firefox profile to ...
1
vote
3answers
146 views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
1
vote
1answer
78 views

Should cookies expire?

Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there's no way to visit the page in the clear text. I'm also using a laptop that ...
1
vote
2answers
83 views

Saving an Id on a cookie. Security point of view?

I'm developing an ASP.NET MVC 5 website, which a user can select some filters, based on those fillers the server process a result, and the user can make a order and pay for it. In my Order table i ...
0
votes
1answer
61 views

How to escape a cookie to cause split response? [closed]

A website takes the following request and sets the "_Add_User" as a cookie in the response: Request GET /cgi-bin/webscr?cmd=_Add_User HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Windows ...
0
votes
1answer
44 views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
8
votes
2answers
991 views

How is the session ID sent securely?

I'm learning session management and I have two questions for which I could not find answers on the web. Once the user is authenticated, the server creates the Session ID and sends it to the client ...
0
votes
1answer
77 views

The purpose of securecookie package from gorilla

I don't understand the purpose of securecokie package from gorilla. https://github.com/gorilla/securecookie/blob/master/securecookie.go. I can see that it's being used get the cookie value on server ...
-1
votes
1answer
173 views

Cookie based sqli [closed]

I have identified a website vulnerable to sql injection via a authentication token. Does anyone know where I can find a tutorial / example of cookie based sql injection?
0
votes
3answers
255 views

What is the most secure way to save user authentication: Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application. All of them will use really confidential ...
1
vote
1answer
203 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
-1
votes
1answer
65 views

Issue regarding vulnerability of cookies [closed]

If someone somehow manages to copy all the cookies from my PC, can they be misused to get my private information or can information be extracted through them? If yes, please suggest some ...
0
votes
1answer
27 views

General concerns with cookies and privacy

The following post is in regards to headless *nix machines only... I know programs like wget allow options to control cookies. However if a program is not HTTP centric, has little or no options for ...
2
votes
0answers
16 views

How to Allow users to save html in Rails application without affecting security [duplicate]

After doing a lot of research I come to this forum hopefully i can get some help. I am building a Ruby on Rails application (version 4.2) My app allow users to create "one page" portfolio : user 1 ...
1
vote
0answers
19 views

List of cookie parameter names to identify load balancing mechanism [duplicate]

I need to create my own web application security assessment methodology. Within fingerprinting section I have one test case such as "Checking for load balancing". One part of that test case is to ...
2
votes
2answers
834 views

Exploiting a potential ASP.NET web app Session Fixation vulnerability

I am pen-testing an ASP.NET application that is exhibiting Session Fixation behavior. The application is using cookie based sessions. Basically: When you land on the page no Session cookie is ...
3
votes
2answers
116 views

Should a session ID ever be sent over an unencrypted connection?

I'm teaching myself a touch of the most basic information security while toying with web dev, so that I can get a better understanding of the whole picture. Let's assume my website has user accounts ...
3
votes
2answers
220 views

Stealing document.cookie from Google domain, is this a privacy breach?

When I am logged into the Google and prints document.cookie I could see following cookies. My doubt is what all an attacker can do if attacker could steal these cookies of the victim using exploiting ...
4
votes
2answers
3k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
1
vote
2answers
187 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token ...
6
votes
4answers
702 views

Can someone steal cookie contents via a phishing attack?

If someone successfully set up a phishing website on a fake wireless network for say, bankofamerica.com, and lets pretend that SSL was not used, would they be able to run a script on the server that ...
3
votes
4answers
196 views

Some sites require that you accept cookies in order to use them. Does this mean that they can read/track my real IP?

The site I want to use says that it stores permanent cookies on my computer to track various things, for instance if I have two accounts with them. It says "Please note that if you set your browser to ...
2
votes
2answers
122 views

The Need for includeSubDomains in HSTS RFC

I am trying to understand the includeSubDomains directive in the HTTP Strict Transport Security standard. In particular section 14.4 of RFC 6797 confuse me. Point 2. says The HTTP request sent to ...
1
vote
2answers
77 views

Overflowing a cookie returns error page in PHP

A PHP application that I am currently testing returned and error page when the value of session cookie is set as a huge string. It leads to information disclosure also. What can I recommend the ...
1
vote
1answer
261 views

What are HSTS Super Cookies?

A few questions : What are HSTS super cookie? How do they work? Why is possible to access them from multiple domains? Do I have to worry and if yes, how to mitigate their effect? Sources ...
2
votes
2answers
972 views

How does X-UIDH user tracking work and how can I detect it?

See these two EFF articles about how Verizon puts a tracker ID in the header of a http request, circumventing anti-cookie measures: Verizon Injecting Perma-Cookies to Track Mobile Customers, ...
2
votes
1answer
65 views

Is there a strong protection against CSRF executed from the sames server via stored XSS?

If we have a domain with stored-XSS vulnerability. I know it's already critical!.. But, I'm talking about limiting the damage. The hacker can't get the session cookie of the admin, because it's ...
0
votes
0answers
40 views

Wordpress cookie discloses admins username [closed]

My wordpress installation has two cookies whose values follows the following format: <admin_username>_<hashvalue> I understand disclosing admin username is a serious security issue. ...