A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

0
votes
2answers
66 views

How to alert webmaster if he does not put contact address

i found a session cookie that contains user status with two parameters NO for standard users when altering this to YES you become a Premium user and you can download content restricted to premium ...
0
votes
1answer
176 views

What are the risks of setting a cookie to have a more global scope? [duplicate]

If I have a subdomain, and I set my cookie's scope to be / instead of examp.example.com. How can it be insecure?
4
votes
1answer
644 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
7
votes
5answers
2k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
2
votes
2answers
292 views

how is Google Ads managing to track me? (even if I don't keep cookies!??) [duplicate]

NOTE: in this question I am interested in discovering the actual method used by Google to track me -in my particular case- and in exploring eventual ways to circumvent it. This is completely different ...
2
votes
2answers
727 views

anti-replay attack for secure cookies?

In the system that i'm working on, we are having some session cookies on the client side that we need to protect against the replay attack ! So I find the following paper ...
1
vote
2answers
86 views

Symmetric encryption involving load balancers - can't randomize key?

I'm working on encrypting a web application's cookie. Using symmetric AES/CBC, I encrypt the cookie data before writing it out, and then decrypt it when reading it back in - the standard stuff. The ...
0
votes
2answers
322 views

Cookie stealing, what prevents a rogue wireless AP from stealing website cookies?

If you set up a rogue AP with the same SSID as a commonly-known wireless access point, what prevents you from forging DNS queries answering with your own web server and stealing people's login ...
3
votes
3answers
253 views

Why Parallels 8 installer looking into my Chrome's Cookies?

While trying to install Parallels on OS X I looked into Activity Monitor to find where is the installed Parallels located (it was weird that it stays invisible in Application folder). And than I found ...
3
votes
2answers
520 views

Reusing the same session-ID necessarily bad?

The question is related to session-ID management in a particular php-based web-app. The web-app uses the same session-ID for each session for a fixed user. So, after logging-out of the application, ...
2
votes
4answers
198 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
5
votes
3answers
913 views

Do I need to expire a session cookie when sessions are handled server-side?

The only data in the cookie is the session ID. There is no expiration timestamp set when creating it, a session is always evaluated server-side to see if it has expired. When logging out, the session ...
4
votes
5answers
2k views

Is a cookie safer than a simple HTTP header?

I was recently told that a cookie is "safer" than a regular old HTTP header, which is safer than a URL parameter, particularly when passing around access tokens. What is the reasoning behind a cookie ...
3
votes
2answers
1k views

If a login/session cookie is stolen,does changing the password void it?

Considering the scenario where a Gmail session/login cookie is hijacked or stolen and it is discovered my means of Gmail last account activity,will changing my password immediately void the cookie or ...
2
votes
1answer
174 views

Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable

Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a ...
5
votes
5answers
4k views

How can I protect myself from Evercookies?

I recently learned about the existence of the Evercookie. Is there any way I can prevent an Evercookie being placed on my computer without disabling JavaScript or cookies entirely? I don't want ...
0
votes
1answer
275 views

How does does the “Sign out all other sessions” feature work in Gmail?

In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
1
vote
1answer
76 views

Couldn't websites that want to track our activity just store the data in the DOM?

For example as the value of an attribute of a html tag. <div cookie='id=1234'></div> Then if the user deletes the cookies while at least one page of the website is open, a javascript ...
1
vote
2answers
418 views

CSRF protection with cookie and AJAX

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question. I have not used CodeIgniter as a programmer, but I have ...
0
votes
2answers
249 views

Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?

As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains. In other ...
3
votes
1answer
781 views

How to MiTM insert an iframe using burp or another tool?

So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer: You visit https://secure.example.com/ which drops a cookie on your ...
1
vote
1answer
111 views

Secure authentication cookie for web site

Hello i want to know if this auth token is secure enough for a site of millions of logged in users: ...
0
votes
5answers
3k views

Store username in cookie for a web site

I want to store the username for a web site in the coockie, is it secure? What an hacker can do with this info?
3
votes
6answers
2k views

Is cookie-based XSS exploitable?

Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself. e.g <span id=statistics>Last visit: ...
2
votes
3answers
329 views

What do web trackers know about/think of me?

Many companies use HTTP cookies, flash cookies, and other analytics to track visitors on the web and classify them. How can I find out what my web profile is currently, and what these trackers are ...
10
votes
5answers
2k views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
2
votes
2answers
1k views

How can Bank of America tell that I'm logging in on a computer I haven't used with them before?

When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
4
votes
1answer
158 views

Resources/materials for implementing secure web services?

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
2
votes
2answers
220 views

Are these two ways safe?

I have two scenarios and want to know if each is secure or which risk there are. Number One: If the User has the edit Link (edit/[md5hash]) he can edit a post. The editkey (the hash) is in an form ...
4
votes
2answers
227 views

Does the ability for a user to choose the value of a session id cookie constitute a security flaw?

In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
3
votes
1answer
2k views

Should cookies that contain non sensitive information be encrypted?

I'm in the process of creating a website and uses cookies to track user login. The only bit of information I store in this cookie is the users username. Should I be encrypting the username even ...
11
votes
3answers
2k views

Protecting against cross-subdomain cookie attacks

I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
1
vote
3answers
6k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
1
vote
2answers
148 views

How do browsers know which cookie to get?

I tried writing a script that would display the contents of a cookie set by another website but it didn't work. <?php echo 'Website cookie is '.$_COOKIE['locale']; ?> But I get an undefined ...
2
votes
1answer
373 views

UUID and Open_id in cookie 'good' enough?

I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients ...
1
vote
2answers
170 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
5
votes
1answer
149 views

What's the risk in putting semantically meaningful data in an HTTP session identifier?

I'm currently looking at performance optimization and am considering a way of speeding up cookie based session handling. There are advantages to having a session identifier in place when there is no ...
1
vote
3answers
510 views

Use Authentication using 2 encrypted strings

So, basically I am trying to log a user in with a cookie and do not query DB to improve performance. Here is a brief idea: Transmit everything via SSL Set a Global secret key A and secret key B ...
1
vote
2answers
268 views

How to check whether the cookie is set securely

I found solution for setting asp.net_sessionid cookie as secure. The solution is to make changes in web.config file as given below. <\system.web> I want to know if this change is setting the ...
2
votes
1answer
130 views

What's the point of rejecting a cookie?

When you access a website, lynx provide the option to reject a cookie, what's the point of doing so? All I thought about is that if you don't accept a cookie, you cookie won't be stolen during a XSS ...
2
votes
2answers
441 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
1
vote
2answers
677 views

What security issues are there when reading cookie with .htaccess?

I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
22
votes
4answers
11k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
1
vote
3answers
240 views

how Cookie tracking threat works?

as explained here and lots of other cases , what is this tracking story ? browser vendors say we have same origin policy and for example google.com can only read cookies saved by google.com or read ...
-1
votes
1answer
322 views

how to secure my login user id and passwords specially for facebook [closed]

i think they hack me with facebook cookies. i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...
0
votes
1answer
543 views

Cookies + CSRF protection + AJAX

In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user ...
1
vote
3answers
518 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
268 views

Is it possible to block third party cookies but allow them when they are first party?

I have been using Cookie Monster in Firefox for a while now to great satisfaction. However, I haven't found a way to allow cookies like Google's on Google's services but block them when I visit other ...
3
votes
3answers
4k views

cookies “secure” flag

How does cookies "secure" attr work to determines whether cookie itself should be included? e.g. [HTTP(unencrypted) connection] 1. user has no cookie yet and tries to log in; 2. user logs in ...
7
votes
3answers
2k views

Is my session-less authentication system secure?

So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...