A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

2
votes
2answers
131 views

How can one secure Exchange 2010 cookies?

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
3
votes
1answer
71 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
1
vote
1answer
158 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
0
votes
1answer
37 views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
0
votes
1answer
47 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
1
vote
0answers
101 views

Accessing Chrome and Gmail on a stolen drive

I was trying to search for this, but could not find the answer anywhere - apology in advance if already answered. I have a Linux desktop installed on a thumb drive, which I keep in my pocket. This ...
1
vote
0answers
116 views

CAS protection against CSRF attacks

A website based on Apache Struts uses central authentication service (cas) for login. I'd like to know if additional csrf protection needs to be provided with Struts in case cas doesn't provide that. ...
1
vote
0answers
57 views

Can one scan multiple websites for tracking cookies and beacons?

Do you know of any tools or techniques that allow one to scan multiple sites for the use of tracking cookies, beacons, web bugs, or offsite javascript includes? As far as I can tell, major web ...
1
vote
0answers
326 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
608 views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
0answers
862 views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
0
votes
0answers
99 views

How to disable x-oracle-dms-ecid cookie

During a security audit, our cliente found that we are sending to the cliente a cookie called 'x-oracle-dms-ecid'. They asked to disable it or change its name. We have been reading all the Oracle ...
0
votes
0answers
53 views

Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?

I won't really go into details of how cookie tossing and cookie overflow attacks work, because this answer explains it perfectly. This post on github explains some mitigation strategies, but does not ...
0
votes
0answers
91 views

Will http only cookie work while using chrome bandwidth saving feature in Android?

I am developing a site which uses http only cookies for authentication. By design[w3 standard] these cookies are XMLHttpObjects and will only be submitted to the domain they originated from to prevent ...