A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

3
votes
1answer
232 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
2
votes
2answers
76 views

Should I regularly erase cookies?

Cookies really do make for a better experience on the web but do they also create a vulnerability? How often should I clean them out and what benefits are gained by doing so?
3
votes
1answer
42 views

Separate third-party cookies for each website

Instead of blocking third-party cookies (which might be useful), why don't browsers allow them, but keep all cookies separate for each address-bar website? For example, if a third-party website sets ...
0
votes
1answer
35 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
2
votes
2answers
75 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
3
votes
1answer
97 views

Session Identification Hashing - How to make it more Secure and Robust

I wrote a PHP class which handles Session and store them in DB instead of normal Files in the server, you can find it on My Session Handler Class In that post a user by name @AnotherGuy has raised ...
2
votes
1answer
58 views

Logout tied to cookie expiry

I am looking for an event to automatically logout a user from the application. Typically I would do it when an inactive session expires. I was wondering if it is secure to do so using cookies. So here ...
2
votes
2answers
48 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
5
votes
4answers
624 views

XSS for stealing cookies … not anymore?

The other day I found a XSS vulnerability in a website that a friend told me to Pentest. It was a page from a school that he's managing, so the important thing here is the login credentials == ...
4
votes
1answer
50 views

Ideal time for cookies to expire?

I get that websites that contain confidential personal information (e.g. banking system) have short sessions and expiration time for cookies for obviously reason. But what are the causes for sites, ...
1
vote
2answers
50 views

Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?

There are several uses for a cookie, and I would like to offer some kind of guarantee that a cookie is being used for a specific, limited purpose and scope. In my case, I want to prove that a cookie ...
4
votes
2answers
66 views

Securely store session data in cookies

I'm trying to create a stateless application server architecture and I would like to store session data in cookies. All pages using the session would be served over HTTPS. I was planning on using ...
7
votes
3answers
343 views

Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few ...
5
votes
3answers
5k views

Cookies “Secure” Flag

How do cookies' "secure" flag work to determine whether cookie itself should be included? e.g. on an HTTP (unencrypted) connection... user has no cookie yet and tries to log in; user logs in ...
16
votes
3answers
26k views

How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?

Firesheep has brought the issue of insecure cookie exchanges to the forefront. How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
4
votes
1answer
61 views

Storing personal information in cookies

I'm trying to do a simple display integration between two websites. One on: domain.com and another on: subdomain.domain.com All I want to do is show a "Hello John, Return to Client Area" ...
1
vote
1answer
71 views

Brute force attack [closed]

I'm trying to make a simple script (brute force attack) on Joomla to try if it works. #! /usr/bin/python import re #regex import urllib import urllib2 x = ...
0
votes
0answers
586 views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
22
votes
6answers
11k views

Secure Session Cookies

While looking up methods for creating secure session cookies I came across this publication: A Secure Cookie Protocol. It proposes the following formula for a session cookie: cookie = user | ...
1
vote
1answer
91 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
0
votes
3answers
275 views

What is the most secure way to save user authentication: Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application. All of them will use really confidential ...
3
votes
4answers
210 views

Some sites require that you accept cookies in order to use them. Does this mean that they can read/track my real IP?

The site I want to use says that it stores permanent cookies on my computer to track various things, for instance if I have two accounts with them. It says "Please note that if you set your browser to ...
3
votes
1answer
55 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
3
votes
1answer
144 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
18
votes
3answers
3k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
8
votes
1answer
1k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § ...
1
vote
1answer
80 views

Should cookies expire?

Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there's no way to visit the page in the clear text. I'm also using a laptop that ...
4
votes
2answers
16k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
1
vote
1answer
104 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
0
votes
1answer
167 views

Setting the HTTPOnly flag for PHPSESSID cookie [closed]

I am getting this message from my security audit: Cookie name: "PHPSESSID" Cookie domain: "xxx.xxx.xx.xxx" If possible, you should set the HTTPOnly flag for this cookie. How can I set ...
1
vote
1answer
328 views

How to disable x-oracle-dms-ecid cookie

During a security audit, our cliente found that we are sending to the cliente a cookie called 'x-oracle-dms-ecid'. They asked to disable it or change its name. We have been reading all the Oracle ...
3
votes
1answer
64 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
0
votes
1answer
191 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
5
votes
3answers
468 views

Is randomizing cookie names a good idea?

What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
4
votes
2answers
3k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
2
votes
2answers
72 views

Is it any more or less secure to delete all my cookies vs. individually logging out?

So I've lost all of my Firefox bookmarks (well not since 3.0) or history (3.5?) or my current session enough times (yeah... this still happens) that I don't leave my precious Firefox profile to ...
1
vote
3answers
152 views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
-1
votes
1answer
65 views

Issue regarding vulnerability of cookies [closed]

If someone somehow manages to copy all the cookies from my PC, can they be misused to get my private information or can information be extracted through them? If yes, please suggest some ...
1
vote
2answers
97 views

Saving an Id on a cookie. Security point of view?

I'm developing an ASP.NET MVC 5 website, which a user can select some filters, based on those fillers the server process a result, and the user can make a order and pay for it. In my Order table i ...
0
votes
1answer
64 views

How to escape a cookie to cause split response? [closed]

A website takes the following request and sets the "_Add_User" as a cookie in the response: Request GET /cgi-bin/webscr?cmd=_Add_User HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Windows ...
0
votes
1answer
44 views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
4
votes
1answer
118 views

How to find out whether an ISP adds a perma-cookie to my requests?

I am interested in finding out whether my (or any) current ISP (Internet Service Provider) uses a technology known as "perma-cookie" oder "sticky cookie" when I am browsing the internet. This ...
8
votes
2answers
1k views

How is the session ID sent securely?

I'm learning session management and I have two questions for which I could not find answers on the web. Once the user is authenticated, the server creates the Session ID and sends it to the client ...
4
votes
3answers
192 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
1
vote
1answer
671 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
0
votes
1answer
80 views

The purpose of securecookie package from gorilla

I don't understand the purpose of securecokie package from gorilla. https://github.com/gorilla/securecookie/blob/master/securecookie.go. I can see that it's being used get the cookie value on server ...
-1
votes
1answer
182 views

Cookie based sqli [closed]

I have identified a website vulnerable to sql injection via a authentication token. Does anyone know where I can find a tutorial / example of cookie based sql injection?
1
vote
1answer
214 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
0
votes
1answer
27 views

General concerns with cookies and privacy

The following post is in regards to headless *nix machines only... I know programs like wget allow options to control cookies. However if a program is not HTTP centric, has little or no options for ...
2
votes
2answers
206 views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...