Tag Info

New answers tagged

1

I know several banks use "profiling data" from previous logins in order to try to determine the identity of the user based on: Credentials (obviously) Secret question (not all banks use this method though) IP address (Geo Location + time zone) and internet provider The device(s) previously used to communicate with the bank: a. Type of web browser, its ...


0

Primarily because it would break things. For example, Facebook Like buttons would stop working because it wouldn't be able to check which Facebook account you are logged into. There are workaround where it shows a pop-up instead, but this is kind of ugly, and it also wouldn't be able to work as a passive page control (e.g. show number of number of likes and ...


1

This is actually not that uncommon a setup. Typically where an application uses stateless cookies, there's no way apart from timeout to invalidate the session. The advantage of this appraoch is that the server doesn't need to maintain a list of valid cookies, which is handy for scaling, the downside is (as you've noticed) if the application has a long ...


2

The cookies could contain anything, and the vulnerability isn't as much about what they contains, as it's about the fact that they can be accessed. The "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability is, in combination with for example a XSS attack, a way to get access to the contents of cookies carrying the httpOnly-flag. An ...


2

A more complete answer from http://hueniverse.com/2015/07/08/on-securing-web-session-ids/ Disclaimer: like any security advice from someone who doesn't know the specifics of your own system, this is for educational purposes only. Security is a complex and very specific area and if you are concerned about the security of your system you should hire an expert ...


4

You have at least 3 ways to achieve that: In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True. If you don't have access to PHP configuration, you can try to overwrite this setting at runtime: ini_set("session.cookie_httponly", 1); If it doesn't work, you have to manually overwrite that cookie: ...


6

site is only available in HTTPS HSTS in this case at least notifies that browser that the site will not be available in HTTP for the foreseeable future. Once the browser knows this (i.e. after the first visit) a downgrade attack like sslstrip will fail, because the browser will not connect with insecure HTTP to the site. The secure flag for cookies ...



Top 50 recent answers are included