Tagged Questions
1
vote
2answers
106 views
What security issues are there when reading cookie with .htaccess?
I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
3
votes
3answers
365 views
cookies “secure” flag
How does cookies "secure" attr work to determines whether cookie itself should be included?
e.g.
[HTTP(unencrypted) connection]
1. user has no cookie yet and tries to log in;
2. user logs in ...
0
votes
0answers
51 views
SSLCipherSuite and cookie creation [closed]
Our corporate server is like this :
Main VIP : abcxyz.xyz.com directing requests to following VIP's:
abcxyz-1.xyz.com
abcxyz-2.xyz.com
The webservers behind abcxyz-1 and abcxyz-2 are on same ...
3
votes
1answer
109 views
Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?
Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
1
vote
2answers
256 views
MITM session injection/invalidation
When sending a cookie back to the server, the browser does not send back the "secure" flag: the server cannot check whether the sent cookie really come from the "secure" origin (https://example.com). ...
1
vote
2answers
142 views
Is it okay from a security perspective to read foreign (untrusted) cookies in a trusted network?
From a security point of view, is it okay to read foreign (untrusted) cookies (from 3rd parties on the Internet) on your internal (trusted) network, or should you only read them within the DMZ areas ...
2
votes
4answers
655 views
Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?
I am developing a web app, which makes HTTP calls as long as the user is not logged in.
Once the user clicks the login button, he is sent to a "login page" that is HTTPS.
The login makes an Ajax call ...
2
votes
2answers
337 views
What if a browser does not understand the secure flag of cookie
I have two questions related to the same:
1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
4
votes
1answer
130 views
What issues might exist with TLS-OBC's emulation of Browser Certificates?
TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
3
votes
2answers
2k views
Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS?
Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set.
Suppose the site is https://www.example.com.
http://www.example.com does not show up, also ...
1
vote
2answers
936 views
SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? [closed]
Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that ...
5
votes
5answers
1k views
Insecure Cookies Because of Load Balancer
I have a load balancer that terminates https requests to http and therefore my backend servers see them as http. As a result, all of my cookies are set without a secure flag when you view cookies on ...
11
votes
2answers
8k views
How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?
Firesheep has brought the issue of insecure cookie exchanges to the forefront.
How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
14
votes
2answers
8k views
How can I check that my cookies are only sent over encrypted https and not http?
I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be ...
