1

can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie. If yes, then how?

I know modern browsers don't allow this. But if you could, then how would you do it??

ps: if you downvote, please make sure to let me know "why" in the comments..

thanks

Improve this question
2
  • 1
    Could you elaborate on what you mean with "on the client side"? Does the attacker have total access to the user's browser, or can he just run JavaScript? Why are you worried about someone modifying a cookie?
    – Sjoerd
    Jan 7, 2019 at 12:46
  • Not all clients are browsers. There are plugins for Firefox (e.g. tamperdata) and probably for other browsers. It can be done on a proxy.
    – symcbean
    Jan 8, 2019 at 16:51

2 Answers 2

Reset to default
2

HTTPONLY is an optional flag denying Javascript to access the cookie, but the user is not constrained by that. It's intended to mitigate Cross Site Scripting, not to protect the cookie from tampering.

can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie?

Yes, and it's trivial. A cookie is in complete control of the user. He could just install an extension to view/edit cookies, or to tamper the request.

Remember that the cookie is an user provided information, and don't blindly trust any cookie. If you need to store user's data, store it serverside, inside a session, and forward only the session cookie to the client. With enough entropy, bruteforcing the session cookie will be close to impossible.

Improve this answer
2
  • 1
    so I've installed this extension called EditThisCookie. though, it doesn't seem to be working. I have my own logged in session cookie of a website in mozilla that I want to replace with the one in chrome. is it possible, since session cookie is httponly.
    – Sumit Wadhwa
    Jan 8, 2019 at 5:54
  • you dont even need an extension, you can do it via the browser itself
    – Nigel Fds
    May 1, 2020 at 7:17
1

Yes, it is entirely possible to alter a cookie that you control (either within the browser or outside the browser) even if an HttpOnly flag has been set. This is possible since you are in complete control of your cookie information and you can replace the cookie's value with any other cookie's value of your choice. Once you do that, it will provide you access to the victim's account.

The main purpose of HttpOnly flag is to prevent session hijacking attacks by exploiting cross-site scripting vulnerabilities i.e. an attacker will not be able to hijack your session cookie by making a malicious request to a web site that has cross-site scripting vulnerabilities if the HttpOnly flag has been set.

UPDATE: If you want to test this within two web browsers (say Mozilla and Chrome), take the following steps:

  1. Install web browser extensions to both Mozilla and Chrome
  2. Log in to your account say in Mozilla and capture the session cookie's value within the browser extension
  3. Access the same website within Chrome
  4. Open the browser extension in Chrome and append the captured cookie value from Mozilla. This should log you in to your account.

I hope this will answer your question!

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .