I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
I was recently told that a cookie is "safer" than a regular old HTTP header, which is safer than a URL parameter, particularly when passing around access tokens. What is the reasoning behind a cookie ...
I'm currently looking at performance optimization and am considering a way of speeding up cookie based session handling. There are advantages to having a session identifier in place when there is no ...
I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
Given the following conditions, Session ID does not change upon login Session ID travels in form of HTTP cookie There is no cross site scripting/redirection vulnerability on the login page is it ...
I have two questions related to the same: 1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side. There is ...
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity. As far as I know, if a cookie is set on a sub-path of the same domain ...
If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties? Are cookies only at risk during login, or am I at risk ...