A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

4
votes
2answers
142 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
1
vote
2answers
73 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
0
votes
1answer
56 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
0
votes
0answers
26 views

What cookie should a STS create?

I'm working on a roll-your-own Federation implementation. There are two RPs. SSO between the RPs does not work (erroneously). I suspect it has to do with the cookie that the STS is creating. The STS ...
0
votes
2answers
149 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
-2
votes
1answer
45 views

is there any way to get the cookie from another tab or iframe's parent in browsers?

i was given a task to find a working way to bypass windows and android browsers same origin policy to be able to get the cookie of an open Tab in victim's browser (like Gmail or ... cookie). but as ...
4
votes
2answers
2k views

Can cookies reveal my email address?

When I visit livescore.com, ten seconds later I receive marketing emails from gambling companies. If I don't visit this site, I don't receive these emails. Similar things happen when I visit Twitter ...
0
votes
2answers
101 views

Anti session-hijacking mechanism using a session variable

Okay, So I'm brainstorming about a security architecture where on a website you have a 'secret' page, where a visitor (not user, just visitor) can enter 'secret' info. The visitor doesn't need to ...
29
votes
2answers
36k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
0
votes
1answer
25 views

Hashing cookie-values & preventing cookie-stealing

I have a problem with understanding how one would securely store a hashed cookie. And how to actually hash a cookie. This is the situation: Every visitor (not user, but also unregistered visitor) of ...
3
votes
2answers
257 views

Is using JWT token for “remember me” less secure than random session token?

I am after reading "https://stormpath.com/blog/token-auth-spa" and "https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence" (among others :-) ) and thing I would like ...
-1
votes
3answers
44 views

How do cookie and session implement for preventing reuse elsewhere

I have some scenarios: A cookie is generated on Chrome and will be used in Firefox in the same machine. A cookie is generated on Chrome and will be used in Chrome on a different machine. A cookie is ...
2
votes
1answer
215 views

How can non-secure or non-HTTP-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and HTTP-only and remaining 5 are neither. In this scenario, in what ways can we ...
1
vote
1answer
32 views

Why would you maintain multiple session ID's in one application?

There is a web application and I am looking at the cookies values after authentication using Burp proxy. There are 5 different cookies, say c1, c2, c3, c4, c5. When I tampered with the values of ...
0
votes
2answers
150 views

Why not have an identical session cookie for different user's devices?

Here is my table structure: // users +----+--------+------------------------+------------------+-------------------------------+ | id | name | email | cookie | /* some ...
1
vote
4answers
97 views

Is it a vulnerability if an application cookies carry sensitive information?

I am assessing a small e-commerce web application. I have found that the application passes the order details, the cost, the order ID etc as a part of the cookie. Tampering with it does not affect the ...
1
vote
2answers
56 views

What cookie request is a suspect request?

I have this table which is containing all users' cookies: (about being login. that's actually "remember me checked") // cookies +----+---------+-------------------+------------+ | id | user_id | ...
1
vote
1answer
46 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
1
vote
3answers
1k views

How to exploit this include_once vulnerability in PHP?

I'm performing a static analysis on a PHP code and came across this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP request: ...
1
vote
2answers
95 views

Risks in avoiding AdBlock detection by importing cookies or simulating the displaying of ads

I've increasingly been finding that many of the websites that I access have now been requesting whitelisting by my adblocker. Sites that do this like Forbes, NDTV, do not allow you to proceed until ...
-1
votes
1answer
67 views

Do I need to detect user's device for “remember me” system? [closed]

I'm following solution #1 of this answer. After a while, there will be some redundant rows in the table. Suppose this table: // cookies +---------+-------------------------+------------------+--------...
1
vote
2answers
78 views

Remember me vs. persistent session for web applications

This question is intended to gather information about what the specific security advantages/disadvantages are to using a "remember me" function for an online web site relying on sessions compared with ...
34
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
5
votes
2answers
101 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
5
votes
1answer
57 views

Can HPKP be used to track users?

There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users? A server could send an extra ...
10
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
1
vote
0answers
213 views

Can one scan multiple websites for tracking cookies and beacons?

Are there any tools or techniques that allow a scan of multiple sites for the use of tracking cookies, beacons, web bugs, or offsite javascript includes? As far as I can tell, major web application ...
2
votes
1answer
108 views

My site is getting hit by 3 crawlers apparently from the EU

Recently my site got a spike in traffic from three crawlers: eu-cookie-law-enforcement-6.xyz law-enforcement-aa.xyz law-enforcement-gg.xyz They link to a warning page about cookies from the EU. ...
1
vote
1answer
51 views

Can proxy server access my cookies and use it?

I recently forgot to turn off proxy and connect through a premium account, will the owner of proxy server be able to use the cookies and access the account?
38
votes
7answers
11k views

Can cookies carry viruses?

I was wondering whether a cookie can carry a virus (or any security-threatening code). In some sense it is similar to a download. So by simply visiting a site, could I get harmed?
12
votes
3answers
2k views

ISPs are now adding unique header identifiers to web traffic. Can this be avoided? If so, how?

I'm a security-conscious Verizon user, and it has recently come to light that Verizon is now serving up my web traffic to ad partners while en route. I understand that once my data has left the device,...
3
votes
1answer
44 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
1
vote
3answers
384 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
1
vote
1answer
48 views

is browser the only app that can set supercookies?

I'm trying to identify a if a website uses tracking cookies beyond ordinary cookies, that get deleted when I click "Delete cookies". The work plan is to run a clean virtual machine, use a software ...
19
votes
5answers
4k views

How to tell if a webapp transmits my password in cleartext?

I am trying to see if a webapp transmit password in some form of cleartext. The problem is that the web app is NOT using https! This is why I wondering is my passwords is sent in clear text. I've ...
3
votes
1answer
109 views

Is setting logon cookies in JavaScript insecure?

I'm facing a limitation in a backend system that can only set a single cookie via the Set-Cookie header which the front end uses to make an AJAX call to log the user in. The authentication system ...
2
votes
1answer
104 views

How to detect, inspect and delete a super cookie of a specific website? [closed]

Definition of supercookie from the paper I am reading: "Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local ...
3
votes
1answer
216 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
38 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
0
votes
3answers
152 views

Does allowing Facebook cookies over TOR threaten my anonymity?

I was using Facebook on TOR without problem - I made no modifications to TOR, I just installed it and used it (except I had to do verification of identifying friends on login). I just switched to ...
3
votes
2answers
69 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
1
vote
1answer
61 views

Why do some websites tell you they use cookies? [closed]

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't? For example:
2
votes
0answers
74 views

If I clear my browsing data, is HSTS protection removed?

I've seen that if I delete cookies and other data on Google Chrome, SSLStrip+ works successfully on those web sites that are not included in the browser list. Is it because HSTS data is cleared too?
0
votes
0answers
73 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
0
votes
0answers
42 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
9
votes
4answers
504 views

Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few ...
1
vote
0answers
50 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
4
votes
2answers
60 views

Securely Erasing Cookies

Is there any sort of officially defined procedure (Eg from IETF) on how to correctly unset a cookie? I've always considered it best practice to unset any session cookies at logout for a web ...
4
votes
2answers
214 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
4
votes
1answer
337 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...