A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

3
votes
2answers
205 views

How can I tell who's using my cookie information on an open LAN?

I think someone is using my cookie info to log into my Facebook account on a public Wi-Fi network. How can I determine if this is happening and from what IP address?
3
votes
1answer
348 views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
3
votes
2answers
105 views

Is it normal for a payment procedure to ask for third party cookies to be turned on?

I was trying to pay for mobile phone credit online from a service provider. I selected the amount to pay and clicked next to continues. The following page asked me to turn on third party cookies if I ...
3
votes
1answer
1k views

CakePHP Set-Cookie Response Header

I am familiar with the cakePHP cookie and session settings but I am unsure as to why (when analyzing through the Burp Proxy Suite I am finding 2 separate Set-Cookie responses: Set-Cookie: ...
3
votes
1answer
151 views

Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?

Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
3
votes
1answer
1k views

Storing users cookies in a database on a server

I want to use Apple Push Notification Service, so I need a server. This server will have to check a site every x minutes. How the site that has to be checked requires the user to login. So is it ok ...
3
votes
1answer
146 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
2
votes
2answers
738 views

Can cookies reveal my email address?

When I visit livescore.com, ten seconds later I receive marketing emails from gambling companies. If I don't visit this site, I don't receive these emails. Similar things happen when I visit Twitter ...
2
votes
3answers
378 views

What do web trackers know about/think of me?

Many companies use HTTP cookies, flash cookies, and other analytics to track visitors on the web and classify them. How can I find out what my web profile is currently, and what these trackers are ...
2
votes
3answers
8k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
2
votes
1answer
130 views

What's the point of rejecting a cookie?

When you access a website, lynx provide the option to reject a cookie, what's the point of doing so? All I thought about is that if you don't accept a cookie, you cookie won't be stolen during a XSS ...
2
votes
2answers
957 views

What if a browser does not understand the secure flag of cookie

I have two questions related to the same: 1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
2
votes
2answers
461 views

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

I'm writing a web app that already uses TLS encrypted connections (HTTPS), Secure; HttpOnly session cookie, HMAC-SHA1 CSRF token, requires correct Referer header to avoid Login CSRF and changes ...
2
votes
1answer
744 views

Signing session cookies

The Play Framework for Scala has support for signed session cookies. In the application configuration file is an "application secret" that is set as a secure random number when the application source ...
2
votes
4answers
205 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
2
votes
2answers
403 views

How attacker can access victim's account without knowing its credentials?

I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy ...
2
votes
1answer
571 views

What is this spam used for?

Recently my secondary e-mail address was exposed by an incident, and soon I received this spam. What is this spam used for?
2
votes
1answer
101 views

What will disabling third party cookies block?

What is the difference between 1st party cookies and 3rd party cookies and what are the pros and cons of disabling it? Will facebook and google (and other ad companies) be completely unable to track ...
2
votes
1answer
144 views

Is this a safe way to identify users connecting to a chat server?

Before I start, all information will go over HTTPS. So, my website is basically like a forum with the authentication part finished and working. This forum has a real time chat application that sends ...
2
votes
1answer
645 views

HeartBleed - how do I invalidate all session cookies?

As part of the Heartbleed event, I have upgraded OpenSSL, reissued and replaced certificates and revoked the old ones and changed passwords however, I am also seeing advice to invalidate all session ...
2
votes
1answer
635 views

Can a webpage read another page's cookies?

I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long ...
2
votes
1answer
2k views

cookie issue with same domain same path but different port

I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
2
votes
1answer
3k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
2
votes
2answers
137 views

Stealing document.cookie from Google domain, is this a privacy breach?

When I am logged into the Google and prints document.cookie I could see following cookies. My doubt is what all an attacker can do if attacker could steal these cookies of the victim using exploiting ...
2
votes
3answers
118 views

Some sites require that you accept cookies in order to use them. Does this mean that they can read/track my real IP?

The site I want to use says that it stores permanent cookies on my computer to track various things, for instance if I have two accounts with them. It says "Please note that if you set your browser to ...
2
votes
2answers
234 views

Are these two ways safe?

I have two scenarios and want to know if each is secure or which risk there are. Number One: If the User has the edit Link (edit/[md5hash]) he can edit a post. The editkey (the hash) is in an form ...
2
votes
2answers
74 views

The Need for includeSubDomains in HSTS RFC

I am trying to understand the includeSubDomains directive in the HTTP Strict Transport Security standard. In particular section 14.4 of RFC 6797 confuse me. Point 2. says The HTTP request sent to ...
2
votes
1answer
52 views

Is there a strong protection against CSRF executed from the sames server via stored XSS?

If we have a domain with stored-XSS vulnerability. I know it's already critical!.. But, I'm talking about limiting the damage. The hacker can't get the session cookie of the admin, because it's ...
2
votes
1answer
92 views

Conversant, CNAME, Cookies, and PCI complaince

We have been asked to evaluate Conversant Tracking. http://www.conversantmedia.com/solutions/enterprise-solutions From what I can tell its pretty straight forward tracking, like google re-marketing, ...
2
votes
1answer
134 views

How do websites tracker cookies and beacon work?

Could someone please enlighten me, either on a technical level or high level if that detail is not feasible, on how tracker cookies and beacons work. Particularly, how information on my browsing ...
2
votes
2answers
398 views

Bypass cookie validation

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this: ...
2
votes
2answers
266 views

Can sessions be handled securely with cookies disabled?

I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...
2
votes
2answers
336 views

how is Google Ads managing to track me? (even if I don't keep cookies!??) [duplicate]

NOTE: in this question I am interested in discovering the actual method used by Google to track me -in my particular case- and in exploring eventual ways to circumvent it. This is completely different ...
2
votes
2answers
894 views

anti-replay attack for secure cookies?

In the system that i'm working on, we are having some session cookies on the client side that we need to protect against the replay attack ! So I find the following paper ...
2
votes
1answer
410 views

UUID and Open_id in cookie 'good' enough?

I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients ...
2
votes
2answers
477 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
2answers
144 views

Exploiting a potential ASP.NET web app Session Fixation vulnerability

I am pen-testing an ASP.NET application that is exhibiting Session Fixation behavior. The application is using cookie based sessions. Basically: When you land on the page no Session cookie is ...
2
votes
2answers
132 views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
2
votes
3answers
141 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
2
votes
1answer
187 views

Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable

Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a ...
2
votes
1answer
473 views

Active Directory: Should Workstations be separated from servers to protect from related domain hacks?

How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack? Suppose there is an AD forest called example.com. This company has a variety of internal and ...
2
votes
1answer
369 views

How does IE's Privacy options affect javascript's ability to save cookies?

I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience. Is there a guide that ...
2
votes
0answers
14 views

How to Allow users to save html in Rails application without affecting security [duplicate]

After doing a lot of research I come to this forum hopefully i can get some help. I am building a Ruby on Rails application (version 4.2) My app allow users to create "one page" portfolio : user 1 ...
2
votes
2answers
236 views

How can one secure Exchange 2010 cookies? [closed]

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
1
vote
5answers
4k views

Store username in cookie for a web site

I want to store the username for a web site in the coockie, is it secure? What an hacker can do with this info?
1
vote
3answers
458 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
1
vote
2answers
89 views

Can you use https only for cookies and not the html?

I have a few questions, all relating to the title. 1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http? 2) Does SE do this / do many ...
1
vote
3answers
560 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
2k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
1
vote
2answers
142 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...