Tag Info

New answers tagged

4

You have at least 3 ways to achieve that: In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True. If you don't have access to PHP configuration, you can try to overwrite this setting at runtime: ini_set("session.cookie_httponly", 1); If it doesn't work, you have to manually overwrite that cookie: ...


5

site is only available in HTTPS HSTS in this case at least notifies that browser that the site will not be available in HTTP for the foreseeable future. Once the browser knows this (i.e. after the first visit) a downgrade attack like sslstrip will fail, because the browser will not connect with insecure HTTP to the site. The secure flag for cookies ...


2

The HttpOnly flag only serves to protect sensitive cookies from scripts. Assuming the load balancing cookie is only concerned with routing through to a specific server and cannot identify a client, there's no harm in this cookie being exposed. A XSS attack will only identify which server the browser is connecting to, and not anything specific to the client ...


3

Eran Hammer, one of the maintainers of the yar session management module for NodeJS, had this to say on the matter: Disclaimer: like any security advice from someone who doesn't know the specifics of your own system, this is for educational purposes only. Security is a complex and very specific area and if you are concerned about the security of ...


29

The author of that JS library seems to have made a common, yet mistaken, assumption, though based on just enough knowledge to get things wrong. You can't just sprinkle magik crypto faerie dust and expect to get more security, like chocolate chips. What the author is missing is that once you sign the session id, and put that in the cookie - the signed ...


0

In Session-based Authentication the Server does all the heavy lifting server-side. Broadly speaking a client authenticates with its credentials and receives a session_id (which can be stored in a cookie) and attaches this to every subsequent outgoing request. So this could be considered a "token" as it is the equivalent of a set of credentials. There is ...


1

It is more insecure. Many competent web developers actually destroy the session on the server side to prevent it from ever being accessed again. For example, a PHP dev might do something like. // Unset all of the session variables. $_SESSION = array(); // If it's desired to kill the session, also delete the session cookie. // Note: This will destroy the ...


5

Logging out is supposed to expire the cookies/sessions, but that depends on the server-side coding. If the cookies were stolen and you only deleted your cookies, then the stolen cookies might still be valid. The choice of deleting vs logging out has more to do with what you are trying to defend against. Cookies contain more data than just the session ...


1

The two answers provided by Jeroen and Orny are good, informative answers that are perfectly accurate. Websites can certainly track you with these sophisticated tracking mechanisms. Whether they actually do this is a different matter. There's little incentive for them to do so since the majority of users aren't using incognito mode, or other means of ...


7

By using incognito mode and using a VPN you are masking two of your fingerprints: Cookies IP Address These are the most common techniques used by websites to identify users today. There is much more information websites can get from your browser to use to identify you. Such as: User Agent HTTP_ACCEPT Headers Browser Plugins Time Zone Screen Size and ...


2

It could still identify you as it looks at a lot of details such as: User-Agent Timezone Browser plugins HTTP_ACCEPT Headers Screen size and color depth System fonts Cookies (which you said you'd delete) Please have a look at https://panopticlick.eff.org and test how "unique" your device / browser is. Hope this gives you some insight in correlating data ...


0

First off, your connection to a website being encrypted does not necessarily mean that your connection is actually secure. It certainly helps, but encryption can differ massively in quality. You might have heard about POODLE, as well as FREAK. Bugs and side effects like these could mean that a sufficiently powerful attacker might be able to break the SSL. ...


1

I came across this thread while resolving to issue myself. The resolution I had is that cookie paths are case sensitive. Here is the related question. http://stackoverflow.com/questions/399982/why-are-cookie-paths-case-sensitive My resolution was to redirect from the landing page to the correct path. Be sure to look out for possible redirect loops. ...



Top 50 recent answers are included