A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

2
votes
1answer
336 views

How does IE's Privacy options affect javascript's ability to save cookies?

I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience. Is there a guide that ...
1
vote
3answers
317 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
3answers
398 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
1
vote
2answers
1k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
1
vote
2answers
62 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
1
vote
1answer
68 views

Couldn't websites that want to track our activity just store the data in the DOM?

For example as the value of an attribute of a html tag. <div cookie='id=1234'></div> Then if the user deletes the cookies while at least one page of the website is open, a javascript ...
1
vote
3answers
3k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
1
vote
2answers
133 views

How do browsers know which cookie to get?

I tried writing a script that would display the contents of a cookie set by another website but it didn't work. <?php echo 'Website cookie is '.$_COOKIE['locale']; ?> But I get an undefined ...
1
vote
2answers
540 views

Are flash cookies still a threat and that persistent?

One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
1
vote
2answers
137 views

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine? Edit Assume the web server has CSRF vulnerability. No hidden token checking ...
1
vote
2answers
70 views

Enforce a time limit on the number of uploads per user

I've done a lot of searching on SE and particularly here in regards to preventing issues or attacks for an image based website to accept image uploads, but I haven't seen anyone mention the idea of ...
1
vote
2answers
184 views

How to check whether the cookie is set securely

I found solution for setting asp.net_sessionid cookie as secure. The solution is to make changes in web.config file as given below. <\system.web> I want to know if this change is setting the ...
1
vote
2answers
431 views

MITM session injection/invalidation

When sending a cookie back to the server, the browser does not send back the "secure" flag: the server cannot check whether the sent cookie really come from the "secure" origin (https://example.com). ...
1
vote
3answers
85 views

What additional mitigations are necessary due to “Continue where I left off”?

I work with sensitive sites that handle financial information, my code protects more than four billion pounds of assets. All of our sites have a logout button and in addition use HttpOnly, Secure, ...
1
vote
1answer
110 views

Signing session cookies

The Play Framework for Scala has support for signed session cookies. In the application configuration file is an "application secret" that is set as a secure random number when the application source ...
1
vote
1answer
86 views

Secure authentication cookie for web site

Hello i want to know if this auth token is secure enough for a site of millions of logged in users: ...
1
vote
3answers
345 views

Use Authentication using 2 encrypted strings

So, basically I am trying to log a user in with a cookie and do not query DB to improve performance. Here is a brief idea: Transmit everything via SSL Set a Global secret key A and secret key B ...
1
vote
2answers
1k views

SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? [closed]

Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that ...
1
vote
2answers
1k views

Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck

I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie. The web ...
1
vote
2answers
201 views

Token based authentication under http

I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
1
vote
2answers
227 views

Is it possible to block third party cookies but allow them when they are first party?

I have been using Cookie Monster in Firefox for a while now to great satisfaction. However, I haven't found a way to allow cookies like Google's on Google's services but block them when I visit other ...
1
vote
2answers
191 views

Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?

From a security point of view, is it okay to read foreign (untrusted) cookies (from 3rd parties on the Internet) on your internal (trusted) network, or should you only read them within the DMZ areas ...
1
vote
1answer
80 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
1answer
125 views

Hashing the cookie token for persistent login

In a login system I'm doing, I'm using a per-user, per-device randomly generated cookie token. A part of the script looks like this: // Generate current device's token $token = ...
1
vote
1answer
96 views

handle user-session-cookie and csrf token correctly for javascript app

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax. They are under the same domain but in different ports. server api ...
1
vote
2answers
68 views

Symmetric encryption involving load balancers - can't randomize key?

I'm working on encrypting a web application's cookie. Using symmetric AES/CBC, I encrypt the cookie data before writing it out, and then decrypt it when reading it back in - the standard stuff. The ...
1
vote
2answers
143 views

Secure cookies and Path Length Constraint

Using apache 2.2.3 on oracle enterprise linux. When setting following setting in httpd.conf: Header edit Set-Cookie ^(.*)$ $1;Secure , cookie generation (which happens on our registration page) ...
1
vote
3answers
563 views

Are tracking cookies illegal?

I have a merchant website. When a user visits the website, a cookie is set. Then when the same user visits the site again, we provide him with suggestions, content that he may enjoy based on what ...
1
vote
0answers
70 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
54 views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
1answer
75 views

Bypass cookie validation

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this: ...
1
vote
0answers
118 views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
1
vote
0answers
196 views

CakePHP Set-Cookie Response Header

I am familiar with the cakePHP cookie and session settings but I am unsure as to why (when analyzing through the Burp Proxy Suite I am finding 2 seperate Set-Cookie responses: Set-Cookie: ...
1
vote
2answers
282 views

CSRF protection with cookie and AJAX

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question. I have not used CodeIgniter as a programmer, but I have ...
1
vote
2answers
582 views

What security issues are there when reading cookie with .htaccess?

I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
0
votes
5answers
1k views

Store username in cookie for a web site

I want to store the username for a web site in the coockie, is it secure? What an hacker can do with this info?
0
votes
2answers
187 views

Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?

As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains. In other ...
0
votes
2answers
67 views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
0
votes
2answers
62 views

How to alert webmaster if he does not put contact address

i found a session cookie that contains user status with two parameters NO for standard users when altering this to YES you become a Premium user and you can download content restricted to premium ...
0
votes
1answer
166 views

How does does the “Sign out all other sessions” feature work in Gmail?

In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
0
votes
1answer
399 views

Cookies + CSRF protection + AJAX

In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user ...
0
votes
2answers
154 views

Is using an SSL Session ID along with a cookie based session verification more secure or not really?

I am using Django which is a web framework for Python. I love it but the session handling is cookie-based. Now over SSL I'm sure it's reasonably "secure" but I don't think there is any kind of fail ...
0
votes
2answers
96 views

Does CRIME also compromise basic access authentication?

CRIME mitigation involves disabling TLS compression. My server offers services only via XML-RPC and does not make use of Cookies, which is what CRIME exploits. Does this mean that I can turn on TLS ...
0
votes
3answers
174 views

how Cookie tracking threat works?

as explained here and lots of other cases , what is this tracking story ? browser vendors say we have same origin policy and for example google.com can only read cookies saved by google.com or read ...
0
votes
1answer
55 views

What kind of encoding/hash it is [closed]

I have email which is stored in Cookie : %2FGl%F8%7E%06%F1S%FEF%10%E0T%B3%95%82BK%D9%D3%94%BC%AE%E1 which is sth like this after convert it with this tool : ...
0
votes
1answer
97 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
0
votes
1answer
52 views

Wouldn't transient cookies for session management increase effectiveness of MITM?

According to wikipedia, a transient cookie (aka session-cookie, in-memory cookie) is forgotten when the user closes the browser. These are also recommended for session cookies by OWASP. I've seen a ...
0
votes
1answer
81 views

What are the risks of setting a cookie to have a more global scope? [duplicate]

If I have a subdomain, and I set my cookie's scope to be / instead of examp.example.com. How can it be insecure?
0
votes
2answers
265 views

Cookie stealing, what prevents a rogue wireless AP from stealing website cookies?

If you set up a rogue AP with the same SSID as a commonly-known wireless access point, what prevents you from forging DNS queries answering with your own web server and stealing people's login ...
0
votes
2answers
142 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...