A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

1
vote
2answers
203 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
1
vote
2answers
840 views

What security issues are there when reading cookie with .htaccess?

I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
0
votes
3answers
815 views

What is the most secure way to save user authentication: Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application. All of them will use really confidential ...
0
votes
2answers
85 views

Legality of cookie(set by other sites) tracking

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to ...
0
votes
2answers
443 views

Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?

As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains. In other ...
0
votes
2answers
2k views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
0
votes
2answers
187 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
0
votes
2answers
421 views

What is actually the purpose of encrypting the values in a cookie?

I was researching on internet security. When I reached at section Cookies, I happened to read that the values inside a cookie are generally stored only after encrypting them. But an encryption can be ...
0
votes
1answer
538 views

My cookies have been stolen. What to do?

About a month and a half ago I got infected by a virus called MSIL.Bladabindi. I noticed the virus quite soon because google notified me that someone from Turkey tried to access my account (I'm in ...
0
votes
2answers
71 views

How to alert webmaster if he does not put contact address

i found a session cookie that contains user status with two parameters NO for standard users when altering this to YES you become a Premium user and you can download content restricted to premium ...
0
votes
1answer
28 views

Javascript Valuable Webpage Data

When malicious users and attackers seek to steal data using XSS, they can send attributes like document.cookie to a malicious server, correct? Does this attribute have all of a users cookies for a ...
0
votes
2answers
898 views

Javascript injection via document.cookie possible?

Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this ...
0
votes
1answer
156 views

Setting a temporary cookie to an invalid value when logout improves security?

When a session is closed, for example, when a timeout triggers or when the user clicks the logout button, the session should be terminated at server side so the session cookie is invalid. I think ...
0
votes
1answer
477 views

How does does the “Sign out all other sessions” feature work in Gmail?

In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
0
votes
1answer
731 views

Cookies + CSRF protection + AJAX

In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user ...
0
votes
1answer
379 views

should I not accept cookies for the sake of anonymity?

Let's say I had a Gmail account. Should I just not have a Gmail account, or should I not use their cookies? How bad are the cookies, in of themselves? I obviously wouldn't log into it, with my VPN or ...
0
votes
1answer
128 views

What are the major threats involved in storing the session identifiers in local storage instead of cookies?

I want to know the major security threats involved in storing the session variables in client side local storage, instead of storing it in the cookies. Can somebody give me a brief description?
0
votes
1answer
794 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
0
votes
2answers
67 views

What conditions allow an attacker to write a cookie?

Some CSRF protection mechanisms are vulnerable to attackers who can write cookies. Others are not but incur extra complexity or computational cost. Help me understand the cost/benefit. What ...
0
votes
2answers
120 views

Does CRIME also compromise basic access authentication?

CRIME mitigation involves disabling TLS compression. My server offers services only via XML-RPC and does not make use of Cookies, which is what CRIME exploits. Does this mean that I can turn on TLS ...
0
votes
1answer
39 views

Accesssing cookies of another domain using Iframes and Javascript

Using Iframe we can embed webpages of another domain provided the X-Frame-Options isn't set to SAMEORIGIN. This also loads the cookie inside the iframe. Now, one can access this cookie if it's in the ...
0
votes
1answer
45 views

Allow visiting website B only if you visited website A first [closed]

Having two websites: A and B. I want that the users that open website B to get redirected to another website (e.g. http://example.com) if they didn't visit the website A. To do this I tried to set a ...
0
votes
1answer
129 views

How to escape a cookie to cause split response? [closed]

A website takes the following request and sets the "_Add_User" as a cookie in the response: Request GET /cgi-bin/webscr?cmd=_Add_User HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Windows ...
0
votes
1answer
118 views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
0
votes
1answer
192 views

The purpose of securecookie package from gorilla

I don't understand the purpose of securecokie package from gorilla. https://github.com/gorilla/securecookie/blob/master/securecookie.go. I can see that it's being used get the cookie value on server ...
0
votes
1answer
40 views

General concerns with cookies and privacy

The following post is in regards to headless *nix machines only... I know programs like wget allow options to control cookies. However if a program is not HTTP centric, has little or no options for ...
0
votes
1answer
2k views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...
0
votes
1answer
218 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
0
votes
2answers
798 views

How session cookies work? [closed]

I want to know the basic working of session cookies. When i tried googling, most of the results came were based on any programming language. I am not good at coding. So it will be helpful if someone ...
0
votes
3answers
530 views

Does it have sense a One-Time Session Cookie?

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites. In each request the server sends a ...
0
votes
1answer
261 views

What kind of encoding/hash it is [closed]

I have email which is stored in Cookie : %2FGl%F8%7E%06%F1S%FEF%10%E0T%B3%95%82BK%D9%D3%94%BC%AE%E1 which is sth like this after convert it with this tool : ...
0
votes
1answer
552 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
0
votes
1answer
437 views

What are the risks of setting a cookie to have a more global scope? [duplicate]

If I have a subdomain, and I set my cookie's scope to be / instead of examp.example.com. How can it be insecure?
0
votes
1answer
922 views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
0
votes
0answers
6 views

Autofill Username Creation [migrated]

As an administrator I have found various usernames in the autofill bar when you attempt to log in to sites. These usernames are unknown and I was wondering if anyone knew of a way that I can find out ...
0
votes
0answers
13 views

Cookies carrying Session identifiers

Is there a list of names for cookies carrying SID's? For instance: PHP by default uses PHPSESSIONID Tomcat uses JSESSIONID ... I would like to be able to intercepts all SID's supplied via ...
0
votes
4answers
93 views

Is session expiration for all web applications possible?

In case someone visits an infected site his safety, if his cookies get stolen, may be compromised. Is there any abstract way to expire a session on the stolen session-id so that the id is practically ...
0
votes
0answers
31 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
0
votes
0answers
976 views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
0
votes
0answers
51 views

Wordpress cookie discloses admins username [closed]

My wordpress installation has two cookies whose values follows the following format: <admin_username>_<hashvalue> I understand disclosing admin username is a serious security issue. ...
0
votes
1answer
189 views

Wouldn't transient cookies for session management increase effectiveness of MITM?

According to wikipedia, a transient cookie (aka session-cookie, in-memory cookie) is forgotten when the user closes the browser. These are also recommended for session cookies by OWASP. I've seen a ...
0
votes
2answers
423 views

Cookie stealing, what prevents a rogue wireless AP from stealing website cookies?

If you set up a rogue AP with the same SSID as a commonly-known wireless access point, what prevents you from forging DNS queries answering with your own web server and stealing people's login ...
0
votes
1answer
128 views

What is a preferred method of security-conscious creation of login cookies [duplicate]

Possible Duplicate: Is it safe to store the password hash in a cookie and use it for “remember-me” login? I am working on a webapp that uses localStorage alone ...
0
votes
0answers
138 views

How can I prevent SESSID stealing? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? How can I prevent someone on same network from stealing SESSIONID and using it in his own browser (it would ...
0
votes
2answers
265 views

How to create a secure login system with cookies? [closed]

For my personal education, I am trying to create a secure login system using cookies. I have read a lot of articles and Stack Overflow questions on how to achieve that, but couldn't find anything ...
-1
votes
2answers
107 views

Is it possible for a website, by knowing the public IP only, to detect the exact smartphone device I'm using?

If with the same smartphone device I surf to one website (each time with a different IP, different SIM card and no saved cookies or cache), is it possile to detect that I'm using the same device? If ...
-1
votes
1answer
84 views

Issue regarding vulnerability of cookies [closed]

If someone somehow manages to copy all the cookies from my PC, can they be misused to get my private information or can information be extracted through them? If yes, please suggest some ...
-1
votes
1answer
685 views

Cookie based sqli [closed]

I have identified a website vulnerable to sql injection via a authentication token. Does anyone know where I can find a tutorial / example of cookie based sql injection?
-1
votes
1answer
260 views

What is cookie reverse engineering? [closed]

I want to know what is this cookie reverse engineering and how to do this is simple words. Thanks in advance.
-1
votes
1answer
397 views

how to secure my login user id and passwords specially for facebook [closed]

i think they hack me with facebook cookies. i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...