I have some scenarios:
- A cookie is generated on Chrome and will be used in Firefox in the same machine.
- A cookie is generated on Chrome and will be used in Chrome on a different machine.
- A cookie is generated on Chrome and will be used in Firefox on a different machine.
In above scenarios, can cookie be reused? If not, how to implement a session/cookie to prevent reuse in those scenarios?
In my opinion, I think a session-cookie is implemented by:
- server stored a key-value pair so: key for identity user. and value for store user data, expired session time ...
- client will store cookie, in that cookie contains key on server.
So above attacks can be prevented by value object stores something such as "browser type", "machine name" (getting ssh value by some way). Every time user requests something, server will get browser type, machine name, cookie and check all data for validity.
But what is the problem if attacker can fake the browser type, machine name? For example, using Firefox but sending Chrome-details as browser-agent instead.