A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

3
votes
1answer
51 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
1
vote
3answers
288 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
0
votes
2answers
86 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
1
vote
1answer
43 views

is browser the only app that can set supercookies?

I'm trying to identify a if a website uses tracking cookies beyond ordinary cookies, that get deleted when I click "Delete cookies". The work plan is to run a clean virtual machine, use a software ...
19
votes
5answers
4k views

How to tell if a webapp transmits my password in cleartext?

I am trying to see if a webapp transmit password in some form of cleartext. The problem is that the web app is NOT using https! This is why I wondering is my passwords is sent in clear text. I've ...
3
votes
1answer
94 views

Is setting logon cookies in JavaScript insecure?

I'm facing a limitation in a backend system that can only set a single cookie via the Set-Cookie header which the front end uses to make an AJAX call to log the user in. The authentication system ...
2
votes
1answer
57 views

How to detect, inspect and delete a super cookie of a specific website? [closed]

Definition of supercookie from the paper I am reading: "Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local ...
1
vote
1answer
26 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
2
votes
1answer
55 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
14 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
0
votes
3answers
121 views

Does allowing Facebook cookies over TOR threaten my anonymity?

I was using Facebook on TOR without problem - I made no modifications to TOR, I just installed it and used it (except I had to do verification of identifying friends on login). I just switched to ...
3
votes
2answers
60 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
0
votes
1answer
52 views

Why do some websites tell you they use cookies? [closed]

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't? For example:
1
vote
1answer
61 views

If I clear my browsing data, is HSTS protection removed?

I've seen that if I delete cookies and other data on Google Chrome, SSLStrip+ works successfully on those web sites that are not included in the browser list. Is it because HSTS data is cleared too?
0
votes
0answers
51 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
0
votes
0answers
39 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
9
votes
4answers
470 views

Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few ...
1
vote
0answers
47 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I ...
4
votes
2answers
51 views

Securely Erasing Cookies

Is there any sort of officially defined procedure (Eg from IETF) on how to correctly unset a cookie? I've always considered it best practice to unset any session cookies at logout for a web ...
4
votes
2answers
210 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
4
votes
1answer
331 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
4
votes
2answers
121 views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...
1
vote
3answers
142 views

Authenticating user in same sub-domain using cookies

We have few in production websites say site1.dom1.com , site2.dom1.com , site3.dom1.com which are just replicas working on different server. Now we want to extend some application on another server ...
1
vote
2answers
99 views

Prevent Session Hijacking, where an attacker steals Session ID(cookie) from the browser physically

Consider a case, where an attacker has physical access of user's machine for 20-30 seconds. The attacker can use this time to steal user's cookie (say using EditThisCookie plugin) and send the cookies ...
1
vote
1answer
74 views

FireFox inadvertedly increasing security?

With the known advent of Flash-based cookies and recently something called super-cookies, security and anonymity has become something more of a luxury rather than the norm and merchants want to ...
6
votes
1answer
115 views

Third-Party-Cookies Tracking - Google Chrome

I've read an article about third-party-cookies which explained that in Google Chrome disabling third-party-cookies will not stop the browser from sending third-party-cookies. So when I visit Facebook ...
10
votes
5answers
5k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
1
vote
2answers
103 views

When should server side sessions be used instead of client side sessions?

From an information security perspective, when should server side sessions be enabled instead of client side sessions? From what I gather, "secure client side sessions" are cookies that contain data ...
1
vote
0answers
49 views

Open source tool to test a WAF against OWASP Top 10? [closed]

Are there any open source tools to test a WAF against OWASP Top 10? Especially I am looking for a tool that tests a WAF against different types of attacks & reports test results.
0
votes
1answer
123 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ...
3
votes
2answers
78 views

In what case should one encrypt cookies?

I am curious how one decides whether to encrypt cookies or not? And if so when should one use public private key over symmetric encryption?
0
votes
1answer
323 views

Accesssing cookies of another domain using Iframes and Javascript

Using Iframe we can embed webpages of another domain provided the X-Frame-Options isn't set to SAMEORIGIN. This also loads the cookie inside the iframe. Now, one can access this cookie if it's in the ...
3
votes
3answers
162 views

What CSRF attacks will 'First-Party-Only' cookies protect against?

The new 'First-Party-Only' cookie attribute: ... allows servers to assert that a cookie ought to be sent only in a "first-party" context. This assertion allows user agents to mitigate ...
0
votes
1answer
48 views

Allow visiting website B only if you visited website A first [closed]

Having two websites: A and B. I want that the users that open website B to get redirected to another website (e.g. http://example.com) if they didn't visit the website A. To do this I tried to set a ...
2
votes
2answers
117 views

Is encrypted cookie without authentication secure enough?

I have some sensitive data in the cookie, e.g. it contains the user id that is later on used to execute the query and we trust the cookie because it is encrypted. All communication happens only on ...
3
votes
1answer
71 views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
2
votes
3answers
284 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
17
votes
3answers
6k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
5
votes
4answers
428 views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
20
votes
2answers
2k views

Stealing Facebook HTTPS cookies with captive portal

I have a security concern. As we know, many public hotspots redirect you to a login screen when you try to surf the first web site. For example, if I connect to such a hotspot and then visit ...
4
votes
2answers
2k views

Can cookies reveal my email address?

When I visit livescore.com, ten seconds later I receive marketing emails from gambling companies. If I don't visit this site, I don't receive these emails. Similar things happen when I visit Twitter ...
7
votes
2answers
251 views

How to find out whether an ISP adds a perma-cookie to my requests?

I am interested in finding out whether my (or any) current ISP (Internet Service Provider) uses a technology known as "perma-cookie" oder "sticky cookie" when I am browsing the internet. This ...
2
votes
1answer
53 views

Is a 'remote' cookie replay attack possible?

Once a cookie is stolen from the session of a legitimate user, can I perform a 'remote' cookie replay attack on that user? I am successfully able to perform a cookie replay attack on the same system, ...
9
votes
1answer
1k views

How is YouTube able to identify anonymous users?

A few days ago I was searching YouTube and I noticed an "outlier" video poped up in the suggestions list. This video had nothing to do with the topic being searched, but instead it was based on a ...
-3
votes
3answers
68 views

How important are my cookies from a security perspective?

If a hacker makes a copy of all my browsing cookies, what could he/she do with that? What are the worst case scenarios?
0
votes
1answer
29 views

Javascript Valuable Webpage Data

When malicious users and attackers seek to steal data using XSS, they can send attributes like document.cookie to a malicious server, correct? Does this attribute have all of a users cookies for a ...
7
votes
3answers
829 views

Why can't cookie hijacking be prevented by associating cookies with IPs? [duplicate]

I just started reading about cookies and all the ways I can get them wrong and allow cookies to be hijacked which allows attackers to do things like impersonate a logged in user. I don't understand ...
0
votes
2answers
473 views

How to create a secure login system with cookies? [closed]

For my personal education, I am trying to create a secure login system using cookies. I have read a lot of articles and Stack Overflow questions on how to achieve that, but couldn't find anything ...
1
vote
4answers
87 views

What are cookies and cache?

While surfing on the Internet, I am often afraid that I may have downloaded some malware program along with some files on my computer. Furthermore, I have been told that the reason for that are ...
0
votes
0answers
15 views

Cookies carrying Session identifiers

Is there a list of names for cookies carrying SID's? For instance: PHP by default uses PHPSESSIONID Tomcat uses JSESSIONID ... I would like to be able to intercepts all SID's supplied via ...