7

Why are the cookies shared between browser tabs? does avoiding this prevent CSRF on cookie based authentication web sites? Is sharing the cookie between tabs favored for easily accessing the website from multiple tabs without authentication?

2 Answers 2

6

Yeah, the cookie is a "browser thing"... not a "tab thing". Is to favor multiple login on the same site on different tabs what in the most of the cases is an advantage.

Yeah, you are right, in the hypothetical case of to have "tab cookies" the CSRF attacks make no sense because as I guess you know very well, the Cross Site Request Forgery attacks are based on:

  • A user have an already existing session on website A.
  • Then, clicking on an evil link maybe on website B or in an email or however, another request is done (this is usually done in other tab) launching a forged request trying to do something on website A "abusing" of the already set existing session or cookie on the victim's browser to perform any "evil action".

If you want a separate session on a browser there are ways to achieve that like using private browsing. That separates the session/cookies from the other sessions. That's because is like "other instance of browser", but between tabs of private browsing you'll share session/cookies in the same way.

Hope it helps.

2

Why are the cookies shared between browser tabs?

Because it would break the entire purpose of cookies.

A cookie has three components:

  1. A domain
  2. Some data
  3. An expiration

Every time your browser makes an http request, it checks the (local) cookie database for any cookies that have a domain matching that of the request; if it finds any, it sends them along to the server.

This mechanism was built to provide persistence for the otherwise stateless http. Without cookies, we would need to provide our username and password on every single request to an authenticated site.

If cookies were universally changed to be per-window, a great many things would quickly get annoying. Not only would you need to log in to Amazon again every time you opened your browser, but you'd need to log in every time you opened it in a new tab - whether that's because you closed the previous one when you were done shopping, or because you're opening results in tabs to compare them.

does avoiding this prevent CSRF on cookie based authentication web sites?

It would combat CSRF, yes. It would not be foolproof, since you would still retain cookies from other sites in that tab.

If you ever attempted to apply this policy to a user, they would immediately find some sort of workaround, and probably end up with a less secure system as a result.

If you want to write a browser plugin to do this for yourself... go ahead, but I suspect you'll find the user experience hit too much very quickly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .