10

Can someone with physical access to a target computer steal the web browser cookies in that and setup a rogue authenticated session later?

Improve this question

1 Answer 1

Reset to default
11

Yes, but the exact implications depend on the authentication techniques used by the website which set the cookies. For example, some websites may have particularly short expiry times for their cookies, or the website may do extra checks (for example IP address or browser user agent) before allowing authentication to continue. In general, session hijacking requires a few things:

  • The cookies must not have naturally reached their expiration date.

  • The cookies alone must be sufficient to authenticate the session (no TLS certs, etc).

  • The user must not have logged out (which would invalidate the cookies).

Some particularly badly-designed sites will not invalidate the cookies server-side when the user logs out or when the cookies reach their expiration date. These websites rely entirely on the browser, and are very easy to hijack once you have the cookies themselves. A well-designed website will keep track of the validity of the cookies independently of the expiration date set in the cookie, and should immediately refuse to accept any authentication cookies after the user logs out.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .