A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

2
votes
1answer
891 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
2
votes
1answer
447 views

What will disabling third party cookies block?

What is the difference between 1st party cookies and 3rd party cookies and what are the pros and cons of disabling it? Will facebook and google (and other ad companies) be completely unable to track ...
2
votes
2answers
881 views

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

I'm writing a web app that already uses TLS encrypted connections (HTTPS), Secure; HttpOnly session cookie, HMAC-SHA1 CSRF token, requires correct Referer header to avoid Login CSRF and changes ...
2
votes
2answers
193 views

Enforce a time limit on the number of uploads per user

I've done a lot of searching on SE and particularly here in regards to preventing issues or attacks for an image based website to accept image uploads, but I haven't seen anyone mention the idea of ...
2
votes
4answers
240 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
2
votes
2answers
534 views

How attacker can access victim's account without knowing its credentials?

I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy ...
2
votes
1answer
614 views

What is this spam used for?

Recently my secondary e-mail address was exposed by an incident, and soon I received this spam. What is this spam used for?
2
votes
1answer
320 views

Is this a safe way to identify users connecting to a chat server?

Before I start, all information will go over HTTPS. So, my website is basically like a forum with the authentication part finished and working. This forum has a real time chat application that sends ...
2
votes
1answer
856 views

HeartBleed - how do I invalidate all session cookies?

As part of the Heartbleed event, I have upgraded OpenSSL, reissued and replaced certificates and revoked the old ones and changed passwords however, I am also seeing advice to invalidate all session ...
2
votes
1answer
2k views

Can a webpage read another page's cookies?

I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long ...
2
votes
1answer
4k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
2
votes
1answer
36 views

How to detect, inspect and delete a super cookie of a specific website?

Definition of supercookie from the paper I am reading: "Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local ...
2
votes
2answers
136 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
2
votes
2answers
479 views

Stealing document.cookie from Google domain, is this a privacy breach?

When I am logged into the Google and prints document.cookie I could see following cookies. My doubt is what all an attacker can do if attacker could steal these cookies of the victim using exploiting ...
2
votes
3answers
278 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
2
votes
2answers
1k views

Token based authentication under http

I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
2
votes
2answers
263 views

Are these two ways safe?

I have two scenarios and want to know if each is secure or which risk there are. Number One: If the User has the edit Link (edit/[md5hash]) he can edit a post. The editkey (the hash) is in an form ...
2
votes
2answers
681 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
1answer
35 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
2
votes
1answer
55 views

What are the risks of allowing the storage of persistent cookies on your system?

Usually, the risks of persistent cookies are described from the point-of-view of the site, not the user: if you implement persistent cookies the probability of someone stealing a cookie and using it ...
2
votes
1answer
119 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - Passport is just a library that is popular for Node.js server authentication - but we have some questions about how to use Passport with ...
2
votes
2answers
387 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
2
votes
2answers
179 views

The Need for includeSubDomains in HSTS RFC

I am trying to understand the includeSubDomains directive in the HTTP Strict Transport Security standard. In particular section 14.4 of RFC 6797 confuse me. Point 2. says The HTTP request sent to ...
2
votes
1answer
2k views

Sharing RSA Public Key for decrypting JWT amongst Load Balanced servers

I'm trying to implement a cookie-less authentication mechanism for a web API that is stateless on the server (does not store session tokens) and can be load balanced across several servers. I have ...
2
votes
1answer
169 views

Conversant, CNAME, Cookies, and PCI complaince

We have been asked to evaluate Conversant Tracking. http://www.conversantmedia.com/solutions/enterprise-solutions From what I can tell its pretty straight forward tracking, like google re-marketing, ...
2
votes
1answer
196 views

Would it be possible to use cookie to store SSL Client Certificate?

Lately, I was reading that article about SSL client certificate. Why is nobody using SSL Client Certificate? The answer was to that question was : In the current state, this excellent idea is ...
2
votes
1answer
359 views

How do websites tracker cookies and beacon work?

Could someone please enlighten me, either on a technical level or high level if that detail is not feasible, on how tracker cookies and beacons work. Particularly, how information on my browsing ...
2
votes
2answers
732 views

Bypass cookie validation

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this: ...
2
votes
2answers
520 views

Can sessions be handled securely with cookies disabled?

I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...
2
votes
1answer
605 views

UUID and Open_id in cookie 'good' enough?

I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients ...
2
votes
2answers
136 views

I delete cookies file in chrome but i'm still logged in after I restart Chrome

I'm using linux and google chrome as browser. I know that cookeis are stored at /home/my_name/.config/google-chrome/Default/Cookies. I deleted this file but it seems like when I restart Chrome and ...
2
votes
2answers
96 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
2
votes
2answers
2k views

Exploiting a potential ASP.NET web app Session Fixation vulnerability

I am pen-testing an ASP.NET application that is exhibiting Session Fixation behavior. The application is using cookie based sessions. Basically: When you land on the page no Session cookie is ...
2
votes
2answers
134 views

What can websites learn about me when I disable cookies?

I run Google Chrome with Ghostery, Privacy Badger, AdBlock and cookies disabled. If, theoretically, Ghostery is blocking all the trackers, AdBlock blocks ads, and I don't accept cookies, what can the ...
2
votes
1answer
456 views

Cookie Tossing explained

Can someone explain to me what cookie tossing is? and how it can be used to hijack someone's session? and also how can we prevent it? I am a bit confused about this subject.
2
votes
1answer
238 views

Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable

Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a ...
2
votes
1answer
566 views

Active Directory: Should Workstations be separated from servers to protect from related domain hacks?

How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack? Suppose there is an AD forest called example.com. This company has a variety of internal and ...
2
votes
1answer
412 views

How does IE's Privacy options affect javascript's ability to save cookies?

I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience. Is there a guide that ...
2
votes
0answers
44 views

Is there any risk if my Google Analytics cookies can be seen by an attacker?

In particular, I'm concerned about a scenario where I'm using GA cookies on a subdomain, e.g. alice.example.com, and the cookies are marked as .example.com, which means that a site on eve.example.com ...
2
votes
0answers
17 views

How to Allow users to save html in Rails application without affecting security [duplicate]

After doing a lot of research I come to this forum hopefully i can get some help. I am building a Ruby on Rails application (version 4.2) My app allow users to create "one page" portfolio : user 1 ...
2
votes
2answers
671 views

How can one secure Exchange 2010 cookies? [closed]

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
2
votes
2answers
610 views

CSRF protection with cookie and AJAX

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question. I have not used CodeIgniter as a programmer, but I have ...
1
vote
5answers
8k views

Store username in cookie for a web site

I want to store the username for a web site in the coockie, is it secure? What an hacker can do with this info?
1
vote
3answers
800 views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
1
vote
3answers
509 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
1
vote
2answers
147 views

Can you use https only for cookies and not the html?

I have a few questions, all relating to the title. 1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http? 2) Does SE do this / do many ...
1
vote
3answers
796 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
2k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
1
vote
2answers
209 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
1
vote
2answers
204 views

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine? Edit Assume the web server has CSRF vulnerability. No hidden token checking ...