Timeline for What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 23, 2015 at 17:52 | comment | added | Ajedi32 | For more on this, see: github.com/blog/1466-yummy-cookies-across-domains | |
| Feb 26, 2015 at 13:19 | comment | added | makerofthings7 | Does FIDO (either one) protect from this attack? | |
| Jul 16, 2013 at 17:53 | comment | added | Nathan | I should also note that digitally signing your cookie content as mentioned above assumes that you are not setting/modifying the cookies client-side (e.g. with JavaScript) - since that would require exposing your private key, which would negate the whole protection mechanism. | |
| Jul 16, 2013 at 17:42 | comment | added | Nathan | You can prevent some attacks by digitally signing your cookie content with a different private key for each individual application. This would allow you to detect when a cookie had been tampered with, and thus reject the request on the server side. This can be done without any special browser support. It would not help you at all with a cookie being "deleted", and you could also potentially still be vulnerable to replay style attacks. | |
| Mar 13, 2012 at 14:11 | comment | added | makerofthings7 | @D.W. - Would you think that TLS-OBC is the best fix for this issue? The W3C Interest group seems to think so. | |
| Mar 6, 2012 at 20:25 | vote | accept | makerofthings7 | ||
| Mar 6, 2012 at 20:07 | comment | added | D.W. | @makerofthings7, sure, whatever works for you. One thought: If you want to know specifically whether there are any servers that detect two cookies with the same name, maybe you'll be more likely to attract attention if you ask a separate question? Whatever you feel is best. | |
| Mar 6, 2012 at 14:36 | comment | added | makerofthings7 | I'm thinking of keeping this Question open longer to see if there are any servers that detect or are immune to this. (Some HTTP Handler might detect two cookies with the same name) Is that a valid idea? | |
| Mar 5, 2012 at 18:15 | comment | added | D.W. |
@YoavAner, my understanding is that you should not count on the path to provide any extra security. For instance, Javascript from a site S can read all cookies for S, regardless of path.
|
|
| Mar 5, 2012 at 9:57 | comment | added | makerofthings7 | Thank you; I think this has implications for Active Directory... your advice on the linked question is appreciated | |
| Mar 5, 2012 at 9:56 | vote | accept | makerofthings7 | ||
| Mar 5, 2012 at 9:57 | |||||
| Mar 5, 2012 at 8:56 | comment | added | Yoav Aner | +1. Great explanation. Are there similar concerns with cookie paths on a single domain? If a cookie is set on /subfolder path then it's not accessible from the root of the domain or another sub-folder, but can the same attacks methods be executed in this case? | |
| Mar 5, 2012 at 7:24 | history | edited | D.W. | CC BY-SA 3.0 |
formatting and overview
|
| Mar 5, 2012 at 7:15 | history | answered | D.W. | CC BY-SA 3.0 |