A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

1
vote
5answers
5k views

Store username in cookie for a web site

I want to store the username for a web site in the coockie, is it secure? What an hacker can do with this info?
1
vote
3answers
92 views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
1
vote
3answers
463 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
1
vote
2answers
92 views

Can you use https only for cookies and not the html?

I have a few questions, all relating to the title. 1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http? 2) Does SE do this / do many ...
1
vote
3answers
589 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
2k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
1
vote
2answers
150 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
1
vote
1answer
64 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
1
vote
1answer
78 views

Couldn't websites that want to track our activity just store the data in the DOM?

For example as the value of an attribute of a html tag. <div cookie='id=1234'></div> Then if the user deletes the cookies while at least one page of the website is open, a javascript ...
1
vote
2answers
168 views

How do browsers know which cookie to get?

I tried writing a script that would display the contents of a cookie set by another website but it didn't work. <?php echo 'Website cookie is '.$_COOKIE['locale']; ?> But I get an undefined ...
1
vote
2answers
620 views

Are flash cookies still a threat and that persistent?

One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
1
vote
2answers
155 views

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine? Edit Assume the web server has CSRF vulnerability. No hidden token checking ...
1
vote
1answer
99 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
1
vote
3answers
450 views

How to exploit this include_once vulnerability in PHP?

I'm performing static analisys on a PHP code and came across with this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP ...
1
vote
2answers
131 views

Enforce a time limit on the number of uploads per user

I've done a lot of searching on SE and particularly here in regards to preventing issues or attacks for an image based website to accept image uploads, but I haven't seen anyone mention the idea of ...
1
vote
2answers
330 views

How to check whether the cookie is set securely

I found solution for setting asp.net_sessionid cookie as secure. The solution is to make changes in web.config file as given below. <\system.web> I want to know if this change is setting the ...
1
vote
2answers
653 views

MITM session injection/invalidation

When sending a cookie back to the server, the browser does not send back the "secure" flag: the server cannot check whether the sent cookie really come from the "secure" origin (https://example.com). ...
1
vote
2answers
75 views

Overflowing a cookie returns error page in PHP

A PHP application that I am currently testing returned and error page when the value of session cookie is set as a huge string. It leads to information disclosure also. What can I recommend the ...
1
vote
2answers
475 views

Will the cookies crumble when it comes to proxy servers?

One important use of proxy servers as I understand reading Wikipedia is to keep you anonymous from other servers by acting as a middle-man. If that is indeed the case, consider the following ...
1
vote
1answer
90 views

Logging in users automatically on a website

I'm making a website that has an extended forum feature, where users can login, post comments, etc. I'm making the feature where the website stores cookies in your computer so the next time you visit ...
1
vote
3answers
270 views

What additional mitigations are necessary due to “Continue where I left off”?

I work with sensitive sites that handle financial information, my code protects more than four billion pounds of assets. All of our sites have a logout button and in addition use HttpOnly, Secure, ...
1
vote
1answer
130 views

Secure authentication cookie for web site

Hello i want to know if this auth token is secure enough for a site of millions of logged in users: ...
1
vote
3answers
615 views

Use Authentication using 2 encrypted strings

So, basically I am trying to log a user in with a cookie and do not query DB to improve performance. Here is a brief idea: Transmit everything via SSL Set a Global secret key A and secret key B ...
1
vote
2answers
266 views

Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?

From a security point of view, is it okay to read foreign (untrusted) cookies (from 3rd parties on the Internet) on your internal (trusted) network, or should you only read them within the DMZ areas ...
1
vote
2answers
1k views

SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? [closed]

Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that ...
1
vote
1answer
150 views

Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity ...
1
vote
1answer
125 views

Would it be possible to use cookie to store SSL Client Certificate?

Lately, I was reading that article about SSL client certificate. Why is nobody using SSL Client Certificate? The answer was to that question was : In the current state, this excellent idea is ...
1
vote
1answer
222 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
2answers
7k views

Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck

I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie. The web ...
1
vote
2answers
799 views

Token based authentication under http

I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
1
vote
3answers
310 views

how Cookie tracking threat works?

as explained here and lots of other cases , what is this tracking story ? browser vendors say we have same origin policy and for example google.com can only read cookies saved by google.com or read ...
1
vote
2answers
286 views

Is it possible to block third party cookies but allow them when they are first party?

I have been using Cookie Monster in Firefox for a while now to great satisfaction. However, I haven't found a way to allow cookies like Google's on Google's services but block them when I visit other ...
1
vote
3answers
1k views

Are tracking cookies illegal?

I have a merchant website. When a user visits the website, a cookie is set. Then when the same user visits the site again, we provide him with suggestions, content that he may enjoy based on what ...
1
vote
2answers
80 views

Saving an Id on a cookie. Security point of view?

I'm developing an ASP.NET MVC 5 website, which a user can select some filters, based on those fillers the server process a result, and the user can make a order and pay for it. In my Order table i ...
1
vote
1answer
64 views

What's the advantage in allowing 3rd party cookies?

I understand why people want to block 3rd party cookies - I would like to know though what would I be missing out from blocking them? Why do browsers like Chrome have them on by default? Is it simply ...
1
vote
1answer
101 views

How does Yandex Alpha sign me in automatically?

I downloaded the new Yandex Alpha browser. When installing, I chose not to make it the default browser and not to send anonymous usage statistics. I never got a prompt whether I wanted to import ...
1
vote
1answer
134 views

Does anything stop applications from reading your saved passwords and cookies from your browser's AppData folder?

Obviously the first answer is "a malicious application can do much worse than that." However, it seems like a really easy thing for an application to read your cookies, saved passwords, etc. from your ...
1
vote
1answer
582 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
1
vote
1answer
617 views

Sharing RSA Public Key for decrypting JWT amongst Load Balanced servers

I'm trying to implement a cookie-less authentication mechanism for a web API that is stateless on the server (does not store session tokens) and can be load balanced across several servers. I have ...
1
vote
1answer
108 views

How can non-secure or non-https-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and https-only and remaining 5 are neither. In this scenario, in what all ways can we ...
1
vote
1answer
233 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, it has the option to "stay logged in" after closing and reopening their ...
1
vote
1answer
225 views

Cookie Tossing explained

Can someone explain to me what cookie tossing is? and how it can be used to hijack someone's session? and also how can we prevent it? I am a bit confused about this subject.
1
vote
1answer
261 views

How to disable x-oracle-dms-ecid cookie

During a security audit, our cliente found that we are sending to the cliente a cookie called 'x-oracle-dms-ecid'. They asked to disable it or change its name. We have been reading all the Oracle ...
1
vote
1answer
753 views

Hashing the cookie token for persistent login

In a login system I'm doing, I'm using a per-user, per-device randomly generated cookie token. A part of the script looks like this: // Generate current device's token $token = ...
1
vote
1answer
180 views

handle user-session-cookie and csrf token correctly for javascript app

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax. They are under the same domain but in different ports. server api ...
1
vote
2answers
96 views

Symmetric encryption involving load balancers - can't randomize key?

I'm working on encrypting a web application's cookie. Using symmetric AES/CBC, I encrypt the cookie data before writing it out, and then decrypt it when reading it back in - the standard stuff. The ...
1
vote
2answers
250 views

Secure cookies and Path Length Constraint

Using apache 2.2.3 on oracle enterprise linux. When setting following setting in httpd.conf: Header edit Set-Cookie ^(.*)$ $1;Secure , cookie generation (which happens on our registration page) ...
1
vote
1answer
49 views

Should cookies expire?

Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there's no way to visit the page in the clear text. I'm also using a laptop that ...
1
vote
0answers
19 views

List of cookie parameter names to identify load balancing mechanism [duplicate]

I need to create my own web application security assessment methodology. Within fingerprinting section I have one test case such as "Checking for load balancing". One part of that test case is to ...
1
vote
0answers
117 views

Accessing Chrome and Gmail on a stolen drive

I was trying to search for this, but could not find the answer anywhere - apology in advance if already answered. I have a Linux desktop installed on a thumb drive, which I keep in my pocket. This ...