A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

0
votes
1answer
79 views

The purpose of securecookie package from gorilla

I don't understand the purpose of securecokie package from gorilla. https://github.com/gorilla/securecookie/blob/master/securecookie.go. I can see that it's being used get the cookie value on server ...
0
votes
1answer
27 views

General concerns with cookies and privacy

The following post is in regards to headless *nix machines only... I know programs like wget allow options to control cookies. However if a program is not HTTP centric, has little or no options for ...
0
votes
1answer
1k views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...
0
votes
1answer
191 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
0
votes
2answers
460 views

How session cookies work? [closed]

I want to know the basic working of session cookies. When i tried googling, most of the results came were based on any programming language. I am not good at coding. So it will be helpful if someone ...
0
votes
3answers
373 views

Does it have sense a One-Time Session Cookie?

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites. In each request the server sends a ...
0
votes
1answer
226 views

What kind of encoding/hash it is [closed]

I have email which is stored in Cookie : %2FGl%F8%7E%06%F1S%FEF%10%E0T%B3%95%82BK%D9%D3%94%BC%AE%E1 which is sth like this after convert it with this tool : ...
0
votes
1answer
411 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
0
votes
1answer
311 views

What are the risks of setting a cookie to have a more global scope? [duplicate]

If I have a subdomain, and I set my cookie's scope to be / instead of examp.example.com. How can it be insecure?
0
votes
1answer
821 views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
0
votes
1answer
35 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
0
votes
0answers
580 views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
0
votes
0answers
40 views

Wordpress cookie discloses admins username [closed]

My wordpress installation has two cookies whose values follows the following format: <admin_username>_<hashvalue> I understand disclosing admin username is a serious security issue. ...
0
votes
0answers
83 views

Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?

I won't really go into details of how cookie tossing and cookie overflow attacks work, because this answer explains it perfectly. This post on github explains some mitigation strategies, but does not ...
0
votes
1answer
172 views

Wouldn't transient cookies for session management increase effectiveness of MITM?

According to wikipedia, a transient cookie (aka session-cookie, in-memory cookie) is forgotten when the user closes the browser. These are also recommended for session cookies by OWASP. I've seen a ...
0
votes
2answers
391 views

Cookie stealing, what prevents a rogue wireless AP from stealing website cookies?

If you set up a rogue AP with the same SSID as a commonly-known wireless access point, what prevents you from forging DNS queries answering with your own web server and stealing people's login ...
0
votes
1answer
119 views

What is a preferred method of security-conscious creation of login cookies [duplicate]

Possible Duplicate: Is it safe to store the password hash in a cookie and use it for “remember-me” login? I am working on a webapp that uses localStorage alone ...
0
votes
0answers
138 views

How can I prevent SESSID stealing? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? How can I prevent someone on same network from stealing SESSIONID and using it in his own browser (it would ...
-1
votes
1answer
65 views

Issue regarding vulnerability of cookies [closed]

If someone somehow manages to copy all the cookies from my PC, can they be misused to get my private information or can information be extracted through them? If yes, please suggest some ...
-1
votes
1answer
181 views

Cookie based sqli [closed]

I have identified a website vulnerable to sql injection via a authentication token. Does anyone know where I can find a tutorial / example of cookie based sql injection?
-1
votes
1answer
188 views

What is cookie reverse engineering? [closed]

I want to know what is this cookie reverse engineering and how to do this is simple words. Thanks in advance.
-1
votes
1answer
378 views

how to secure my login user id and passwords specially for facebook [closed]

i think they hack me with facebook cookies. i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...
-1
votes
1answer
166 views

Comparing cookie values with page parameters (i.e. href)

Could you suggest if there is any reason to compare cookie value domain, path, etc with web "location.href" and so on? I mean - on the client side.
-2
votes
2answers
434 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
-5
votes
5answers
394 views

What is the difference between session fixation and session recreation?

I have read that both of them are conventionally the same. But there must be a few differences which differentiates the two terms. Anyone please explain.