1

I was wondering if what kind of information a cookie is allowed to reveal. As an example i was testing a website and I see in Burp that its cookie contains several pieces of information one of which is "previousLoggedInAs" identifier which identifies the previous logged in user of the application in plain text( just the username). I certainly feel that this should not have happened but cant figure out a way this may be used by attackers and how best it can be avoided ?

Any ideas ?

2

It can be used by an attacker with access to cookies to determine the username of the last person who logged into that site using that browser. It can also possibly reveal a person's other account if they have multiple of them and were previously logged in using the other one and did not clear their cookies (which to be fair isn't necessary assuming they trust the site and expect logging out to fully log them out and not leave references to their account in cookies).

I am not sure why the server needs that information nor how is it used but there may be a vulnerability where the server blindly trusts the value and allows some kind of access based on it. In that case an attacker could set the cookie to anything they want and impersonate the corresponding user.

How to avoid it? Not set the value in the first place - again I am not sure what purpose it could serve, but if you truly do need such a value, keep it in the server's session instead. The client will not be able to see nor tamper with the value that way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.