A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

6
votes
4answers
2k views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until ...
6
votes
2answers
410 views

What protects cookies?

What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't ...
6
votes
1answer
1k views

'Remember Me' combined with Auth Token

I've developed a client application which talks over a REST API to a server. The way the application works is to send the username/pwd pair in the initial login to the server and then respond with an ...
6
votes
1answer
340 views

What countries have laws in place that respect Do Not Track HTTP headers or cookies?

Google offers a Chrome plugin that uses cookies to control privacy, while Firefox offers a HTTP Header to tell websites to not track the users and log the data anonymously. This obviously extends a ...
6
votes
0answers
67 views

Third-Party-Cookies Tracking - Google Chrome

I've read an article about third-party-cookies which explained that in Google Chrome disabling third-party-cookies will not stop the browser from sending third-party-cookies. So when I visit Facebook ...
5
votes
3answers
5k views

Cookies “Secure” Flag

How do cookies' "secure" flag work to determine whether cookie itself should be included? e.g. on an HTTP (unencrypted) connection... user has no cookie yet and tries to log in; user logs in ...
5
votes
3answers
491 views

Is randomizing cookie names a good idea?

What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
5
votes
3answers
723 views

Are there security (esp. privacy) benefits to deleting cookies?

As the title says, I'm wondering if there are any security/privacy benefits to managing cookies - that is, managing by deleting cookies you don't want or need. I deleted all my cookies about a week ...
5
votes
4answers
762 views

XSS for stealing cookies … not anymore?

The other day I found a XSS vulnerability in a website that a friend told me to Pentest. It was a page from a school that he's managing, so the important thing here is the login credentials == ...
5
votes
3answers
1k views

Do I need to expire a session cookie when sessions are handled server-side?

The only data in the cookie is the session ID. There is no expiration timestamp set when creating it, a session is always evaluated server-side to see if it has expired. When logging out, the session ...
5
votes
3answers
312 views

What are the security implications of allowing unlimited size cookies?

Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size. Are there any exploits involving large cookies? i.e. How much more ...
5
votes
1answer
128 views

Ideal time for cookies to expire?

I get that websites that contain confidential personal information (e.g. banking system) have short sessions and expiration time for cookies for obviously reason. But what are the causes for sites, ...
5
votes
1answer
893 views

What kind of vulnerability would this exploit?

We're currently having our website pentested, and looking through our logs, a cookie we set (our allowCookies cookie) has had the value set to ...
5
votes
2answers
6k views

Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?

Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set. Suppose the site is https://www.example.com. http://www.example.com does not show up, also ...
5
votes
1answer
229 views

DNS Rebinding attack - will the victim's browser send cookies?

How does a DNS Rebinding attack works? How can it violate the Same-origin policy? Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is ...
5
votes
1answer
488 views

Using javascript, is it possible to iterate through all cookies saved in the user browser and send them to me?

Again, I am new to the programming and security world. I should mention that it is just a theoretical question so I can anticipate this kind of attack. Using javascript, is it possible to iterate ...
5
votes
4answers
352 views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
5
votes
1answer
820 views

A Secure Cookie Protocol

As title says I'm trying to implement a secure cookie protocol HMAC(username|expiration name|data|session key, sk) It seams that session key is not constant during whole application session ...
5
votes
1answer
281 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
5
votes
2answers
1k views

anti-replay attack for secure cookies?

In the system that i'm working on, we are having some session cookies on the client side that we need to protect against the replay attack ! So I find the following paper ...
5
votes
2answers
8k views

Best way to securely set a session cookie on another domain

We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com. The www site does not have an SSL certificate and is on a different domain. We have a login button on http://www.foo.co.uk ...
5
votes
1answer
581 views

Secure web user authentication even after server-side database compromise

By now, we should all know to use bcrypt or scrypt to store salted password hashes with a sufficient number of rounds. (See, e.g., https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) The ...
5
votes
1answer
182 views

What's the risk in putting semantically meaningful data in an HTTP session identifier?

I'm currently looking at performance optimization and am considering a way of speeding up cookie based session handling. There are advantages to having a session identifier in place when there is no ...
4
votes
2answers
2k views

Can cookies reveal my email address?

When I visit livescore.com, ten seconds later I receive marketing emails from gambling companies. If I don't visit this site, I don't receive these emails. Similar things happen when I visit Twitter ...
4
votes
5answers
753 views

Does setting the cookie-path protect me from XSS from another context?

Lets say I am using a reverse proxy with URL rewriting that provides access to 2 different applications http://www.example.com/app1/ and http://www.example.com/app2/. I don't want those ...
4
votes
1answer
4k views

Are passwords stored in the cookie? encrypted?

Whenever I connect to security.stack.exchange, I am automatically logged in. I haven't allowed the browser to store my password. When I delete all cookies stored by the security.stack.exchange, I have ...
4
votes
2answers
2k views

Are PHP Sessions based on cookies or a cookie-IP pair?

I have a PHP website and my question is: If someone manages to steal my users' cookies via an XSS attack, is it enough for him to be identified as the user? Or does his IP also have to be the same as ...
4
votes
2answers
358 views

Why Sniff Session Cookies when UN/PW should also be available?

I've recently been reading on session cookies and how they can be hijacked via man-in-middle attacks. It seems this is mainly possible on an unencrypted connection between a client and a webserver. ...
4
votes
2answers
592 views

Security concerns about my webapp

I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
4
votes
2answers
23k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
4
votes
6answers
5k views

Is cookie-based XSS exploitable?

Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself. e.g <span id=statistics>Last visit: ...
4
votes
3answers
16k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
4
votes
3answers
240 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
4
votes
4answers
5k views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
4
votes
1answer
1k views

Signing session cookies

The Play Framework for Scala has support for signed session cookies. In the application configuration file is an "application secret" that is set as a secure random number when the application source ...
4
votes
3answers
1k views

Session fixation attack

Given the following conditions, Session ID does not change upon login Session ID travels in form of HTTP cookie There is no cross site scripting/redirection vulnerability on the login page is it ...
4
votes
2answers
132 views

Securely store session data in cookies

I'm trying to create a stateless application server architecture and I would like to store session data in cookies. All pages using the session would be served over HTTPS. I was planning on using ...
4
votes
2answers
261 views

Does the ability for a user to choose the value of a session id cookie constitute a security flaw?

In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
4
votes
2answers
246 views

Is HTTPS redirecting to HTTP a vulnerability?

Let's say a user is authenticated, and the entire account authentication process happened under secure HTTPS. Upon successful login, the user is redirected back to the homepage. However, the homepage ...
4
votes
1answer
163 views

Resources/materials for implementing secure web services?

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
4
votes
3answers
972 views

Deciding whether user has left the site without logging out or has simply left the site open for notifications without actually doing any work?

I am developing my site using server side sessions using redis as backend for saving the session. Now the issue which is bothering me is of user leaving the website without logging out. I mean user ...
4
votes
2answers
119 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
4
votes
1answer
114 views

Storing personal information in cookies

I'm trying to do a simple display integration between two websites. One on: domain.com and another on: subdomain.domain.com All I want to do is show a "Hello John, Return to Client Area" ...
4
votes
1answer
2k views

How to detect cookie stuffing attacks?

So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
4
votes
1answer
689 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
4
votes
2answers
1k views

How does X-UIDH user tracking work and how can I detect it?

See these two EFF articles about how Verizon puts a tracker ID in the header of a http request, circumventing anti-cookie measures: Verizon Injecting Perma-Cookies to Track Mobile Customers, ...
4
votes
1answer
2k views

CakePHP Set-Cookie Response Header

I am familiar with the cakePHP cookie and session settings but I am unsure as to why (when analyzing through the Burp Proxy Suite I am finding 2 separate Set-Cookie responses: Set-Cookie: ...
4
votes
1answer
970 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
4
votes
1answer
348 views

XSS via PDF when Content-Disposition: Inline?

There are kind of two questions here: Is it possible to have XSS in a PDF file when the Content-Disposition: is "inline"? If it is possible, does the pdf get access to the cookies for that domain ...
3
votes
2answers
936 views

Reusing the same session-ID necessarily bad?

The question is related to session-ID management in a particular php-based web-app. The web-app uses the same session-ID for each session for a fixed user. So, after logging-out of the application, ...