A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

1
vote
2answers
77 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
0
votes
2answers
153 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
1
vote
1answer
47 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
2
votes
0answers
74 views

If I clear my browsing data, is HSTS protection removed?

I've seen that if I delete cookies and other data on Google Chrome, SSLStrip+ works successfully on those web sites that are not included in the browser list. Is it because HSTS data is cleared too?
2
votes
0answers
45 views

Is there any risk if my Google Analytics cookies can be seen by an attacker?

In particular, I'm concerned about a scenario where I'm using GA cookies on a subdomain, e.g. alice.example.com, and the cookies are marked as .example.com, which means that a site on eve.example.com ...
1
vote
0answers
51 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
1
vote
0answers
1k views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
1
vote
0answers
139 views

Accessing Chrome and Gmail on a stolen drive

I was trying to search for this, but could not find the answer anywhere - apology in advance if already answered. I have a Linux desktop installed on a thumb drive, which I keep in my pocket. This ...
1
vote
0answers
135 views

Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?

I won't really go into details of how cookie tossing and cookie overflow attacks work, because this answer explains it perfectly. This post on github explains some mitigation strategies, but does not ...
1
vote
0answers
213 views

Can one scan multiple websites for tracking cookies and beacons?

Are there any tools or techniques that allow a scan of multiple sites for the use of tracking cookies, beacons, web bugs, or offsite javascript includes? As far as I can tell, major web application ...
1
vote
0answers
651 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
2k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
0answers
2k views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
0
votes
0answers
26 views

What cookie should a STS create?

I'm working on a roll-your-own Federation implementation. There are two RPs. SSO between the RPs does not work (erroneously). I suspect it has to do with the cookie that the STS is creating. The STS ...
0
votes
0answers
43 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
0
votes
0answers
73 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
0
votes
0answers
42 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
0
votes
0answers
22 views

Cookies carrying Session identifiers

Is there a list of names for cookies carrying SID's? For instance: PHP by default uses PHPSESSIONID Tomcat uses JSESSIONID ... I would like to be able to intercepts all SID's supplied via ...
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
0
votes
0answers
319 views

CAS protection against CSRF attacks

A website based on Apache Struts uses central authentication service (cas) for login. I'd like to know if additional csrf protection needs to be provided with Struts in case cas doesn't provide that. ...