Tag Info

New answers tagged

2

Create a cryptographically secure random token and associate it with the user id in your DB Perform an HMAC on the token the cookie value will then be token+HMAC This way an attacker would have to know your HMAC key in order to brute force the token and that is not possible. For validating the cookie you first extract the HMAC, validate the authenticity ...


4

You should ensure that your session token is random and at least 128 bits. Aside from that you just basically send a session token and a user id. To be fair, only your session token should be needed to identify a user since it is unique. Ensure also that you destroy the session token after the user logs out. Aside from that it seems similar to any other ...


1

I do the following to force youtube to "forget" me. Use firefox (just because I think it's better, but this shouldn't be required) Configure flash to not store any data (right click on a flash app/video, select global settings, storage tab -> "block all sites from storing information on this computer") Now when you delete the cookies, google won't be able ...


4

In addition to Xander's point that the HTML document is an entire structure, not separate elements: The security of HTTPS is partially derived from the user recognizing that HTTPS is present. If the document were transmitted over HTTP and settings were over HTTPS, the browser would flag the page as HTTP, so the user would not have a way to recognize a ...


0

I think the pen test team misspoke. MITM is a much more serious threat than a XSS, because the MITM attacker can monitor and replace any of the content of your site. It's invalid to complain about the content of a site attributing a MITM attack, because the content is irrelevant to a MITM. MITM can always inject content into your site. XSS is a ...


4

No. A response (and the associated request) is a single entity composed of headers (one of which is the cookies) and the body (in the case of the response, often HTML. They are not separate. Since the answer to question 1 is no, the answers to questions 2, 3, and 4 are also necessarily no, since this is not possible to do.


0

Man-in-the-middle might not be the only way to manipulate the cookie. If, for example, the cookie is used for example.org and you have subdomains like user1.example.org which you either don't control or which might have XSS problems, then it will be possible to set the cookie for example.org from user1.example.org. You will probably not be able to read it, ...


1

You would normally be correct, however you cannot protect against this MITM vulnerability even if you use a secure cookie over SSL. This cookie could still be MITM'd to inject XSS. The pen test report is correct - the fact that the XSS mechanism is a cookie gives rise to the MITM vulnerability. This is because the Same Origin Policy for cookies does not ...


2

A cookie has only one function: to be sent back to the server. It is stored on the client, but the client does not understand its contents; and the client does not use it except by sending it back. Which basically explains that the "answer" you quote is not a real answer: it tries to side-step the problem by stating that side-stepping the problem would be ...


0

Perhaps, but if there is a script performing attacks with the session cookie immediately after it is intercepted the damage will already be done. If a person is interacting with the session data they may not be able to act fast enough. Really, this means that you would be mitigating untargeted or unsophisticated attacks.



Top 50 recent answers are included