1
vote
2answers
63 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
0
votes
2answers
75 views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
1
vote
1answer
79 views

Bypass cookie validation

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this: ...
2
votes
1answer
272 views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
1
vote
1answer
100 views

handle user-session-cookie and csrf token correctly for javascript app

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax. They are under the same domain but in different ports. server api ...
5
votes
5answers
854 views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
3
votes
6answers
973 views

Is cookie-based XSS exploitable?

Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself. e.g <span id=statistics>Last visit: ...
10
votes
5answers
988 views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
0
votes
2answers
143 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
2
votes
2answers
323 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
3
votes
5answers
391 views

Does setting the cookie-path protect me from XSS from another context?

Lets say I am using a reverse proxy with URL rewriting that provides access to 2 different applications http://www.example.com/app1/ and http://www.example.com/app2/. I don't want those ...
1
vote
2answers
2k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
3
votes
5answers
357 views

Is it possible to see if a script on a website steals session cookies?

I'm looking as some web analytics solutions, I know it sounds paranoid. but cookie-based web analytics need for you to paste their JavaScript code on your web-site. I don't like the idea too much of ...
4
votes
2answers
1k views

Are PHP Sessions based on cookies or a cookie-IP pair?

I have a PHP website and my question is: If someone manages to steal my users' cookies via an XSS attack, is it enough for him to be identified as the user? Or does his IP also have to be the same as ...