Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?
I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...