A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...
3
votes
2answers
754 views
Why are CSRF tokens necessary?
It seems that the entire problem could be solved very elegantly by simply adding a new flag to the HTTP cookie specification.
Similarly to how cookies flagged Secure will only be submitted by the ...
3
votes
1answer
1k views
cookie path protection within same domain
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity.
As far as I know, if a cookie is set on a sub-path of the same domain ...
3
votes
2answers
174 views
Computer-level logging by financial institutions
I am looking for the best approach to recognizing a specific computer and saving that computer as a "safe" login machine. My intuition points me to using cookies, but what value do I store in there to ...
3
votes
1answer
147 views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
3
votes
2answers
2k views
Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?
Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set.
Suppose the site is https://www.example.com.
http://www.example.com does not show up, also ...
3
votes
1answer
130 views
Session Token Embedded in Form
I have a session token that's stored in a browser cookie client side. The cookie is already available for scripting and it's used to validate XHR through Javascript. For a particular page I'm using ...
3
votes
3answers
131 views
Does the ability for a user to choose the value of a session id cookie constitute a security flaw?
In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
3
votes
2answers
160 views
How can I tell who's using my cookie information on an open LAN?
I think someone is using my cookie info to log into my Facebook account on a public Wi-Fi network. How can I determine if this is happening and from what IP address?
3
votes
1answer
108 views
Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?
Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
2
votes
4answers
654 views
Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?
I am developing a web app, which makes HTTP calls as long as the user is not logged in.
Once the user clicks the login button, he is sent to a "login page" that is HTTPS.
The login makes an Ajax call ...
2
votes
1answer
101 views
What's the point of rejecting a cookie?
When you access a website, lynx provide the option to reject a cookie, what's the point of doing so?
All I thought about is that if you don't accept a cookie, you cookie won't be stolen during a XSS ...
2
votes
2answers
337 views
What if a browser does not understand the secure flag of cookie
I have two questions related to the same:
1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
2
votes
2answers
148 views
How attacker can access victim's account without knowing its credentials?
I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy ...
2
votes
2answers
406 views
Is my current method of handling session cookies insecure?
I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security.
Each user can have several accounts. For ...
2
votes
1answer
307 views
What is this spam used for?
Recently my secondary e-mail address was exposed by an incident, and soon I received this spam. What is this spam used for?
2
votes
3answers
369 views
Session fixation attack
Given the following conditions,
Session ID does not change upon login
Session ID travels in form of HTTP cookie
There is no cross site scripting/redirection vulnerability on the login page
is it ...
2
votes
1answer
146 views
How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
2
votes
2answers
134 views
Are these two ways safe?
I have two scenarios and want to know if each is secure or which risk there are.
Number One:
If the User has the edit Link (edit/[md5hash]) he can edit a post. The editkey (the hash) is in an form ...
2
votes
1answer
79 views
Should cookies that contain non sensitive information be encrypted?
I'm in the process of creating a website and uses cookies to track user login. The only bit of information I store in this cookie is the users username.
Should I be encrypting the username even ...
2
votes
2answers
150 views
HTTPOnly Cookies: Security Depends on Client Cooperation?
I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means.
I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
1answer
201 views
cookie issue with same domain same path but different port
I have two web app running on same host on same path but on different port
http://somedomain.com/
and
https://somedomain.com/
now when I visit first app it serves the cookie say with name abc, and ...
2
votes
2answers
10 views
Is cookie-based XSS exploitable?
Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself.
e.g <span id=statistics>Last visit: ...
2
votes
1answer
117 views
UUID and Open_id in cookie 'good' enough?
I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients ...
2
votes
1answer
241 views
Active Directory: Should Workstations be separated from servers to protect from related domain hacks?
How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack?
Suppose there is an AD forest called example.com. This company has a variety of internal and ...
2
votes
1answer
265 views
How does IE's Privacy options affect javascript's ability to save cookies?
I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience.
Is there a guide that ...
2
votes
1answer
464 views
Storing users cookies in a database on a server
I want to use Apple Push Notification Service, so I need a server. This server will have to check a site every x minutes.
How the site that has to be checked requires the user to login.
So is it ok ...
1
vote
3answers
290 views
Is this approach of securing cookie secure?
I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt)
Steps:
User logs in
Save user IP + randomstring in ...
1
vote
2answers
1k views
header injection + codeigniter
I'm reading through Mozilla's Secure Coding Guidelines, and found this statement:
Don't trust any user data (input, headers, cookies etc). Validate it before using it
I'm using the codeigniter ...
1
vote
2answers
90 views
How do browsers know which cookie to get?
I tried writing a script that would display the contents of a cookie set by another website but it didn't work.
<?php
echo 'Website cookie is '.$_COOKIE['locale'];
?>
But I get an undefined ...
1
vote
3answers
126 views
Web Application - Cookie Expiry
We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
450 views
Are flash cookies still a threat and that persistent?
One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
1
vote
2answers
122 views
I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?
I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?
Edit
Assume the web server has CSRF vulnerability. No hidden token checking ...
1
vote
2answers
108 views
How to check whether the cookie is set securely
I found solution for setting asp.net_sessionid cookie as secure.
The solution is to make changes in web.config file as given below.
<\system.web>
I want to know if this change is setting the ...
1
vote
2answers
256 views
MITM session injection/invalidation
When sending a cookie back to the server, the browser does not send back the "secure" flag: the server cannot check whether the sent cookie really come from the "secure" origin (https://example.com). ...
1
vote
3answers
120 views
Use Authentication using 2 encrypted strings
So, basically I am trying to log a user in with a cookie and do not query DB to improve performance.
Here is a brief idea:
Transmit everything via SSL
Set a Global secret key A and secret key B
...
1
vote
2answers
936 views
SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? [closed]
Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that ...
1
vote
2answers
34 views
What do web trackers know about/think of me?
Many companies use HTTP cookies, flash cookies, and other analytics to track visitors on the web and classify them. How can I find out what my web profile is currently, and what these trackers are ...
1
vote
3answers
193 views
What typically is the expiration date of a session cookie?
I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
1
vote
2answers
169 views
Is it possible to block third party cookies but allow them when they are first party?
I have been using Cookie Monster in Firefox for a while now to great satisfaction. However, I haven't found a way to allow cookies like Google's on Google's services but block them when I visit other ...
1
vote
1answer
503 views
Stopping Session Hijacking
If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
1
vote
2answers
142 views
Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?
From a security point of view, is it okay to read foreign (untrusted) cookies (from 3rd parties on the Internet) on your internal (trusted) network, or should you only read them within the DMZ areas ...
1
vote
2answers
97 views
Secure cookies and Path Length Constraint
Using apache 2.2.3 on oracle enterprise linux.
When setting following setting in httpd.conf:
Header edit Set-Cookie ^(.*)$ $1;Secure ,
cookie generation (which happens on our registration page) ...
1
vote
3answers
239 views
Are tracking cookies illegal?
I have a merchant website. When a user visits the website, a cookie is set. Then when the same user visits the site again, we provide him with suggestions, content that he may enjoy based on what ...
1
vote
0answers
66 views
How can I implement authentication in my proxy server?
I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet.
So far I am aware of IP and/or MAC address based authentication.
...
1
vote
2answers
94 views
Guarding against XSS when setting Cookies based on URI?
I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
1
vote
2answers
104 views
What security issues are there when reading cookie with .htaccess?
I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
0
votes
1answer
223 views
Cookies + CSRF protection + AJAX
In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user ...
0
votes
3answers
101 views
how Cookie tracking threat works?
as explained here and lots of other cases , what is this tracking story ? browser vendors say we have same origin policy and for example google.com can only read cookies saved by google.com or read ...
0
votes
0answers
51 views
SSLCipherSuite and cookie creation [closed]
Our corporate server is like this :
Main VIP : abcxyz.xyz.com directing requests to following VIP's:
abcxyz-1.xyz.com
abcxyz-2.xyz.com
The webservers behind abcxyz-1 and abcxyz-2 are on same ...
0
votes
1answer
57 views
What is a preferred method of security-conscious creation of login cookies [duplicate]
Possible Duplicate:
Is it safe to store the password hash in a cookie and use it for “remember-me” login?
I am working on a webapp that uses localStorage alone ...
