0

TLDR;

Copying the request from ChromeDevTools along with all cookies allows me to view pages that I should not be able to view after logging in.

Have I been pwned ?


I just found a terrifyingly easy way to view pages that should be visible to someone only if they are logged in.

Let's say I hit the URL www.xyz.com/profile.html

If I am not logged in then I should be redirected to the login page right ? That is if the login cookie is not set then it will be assumed I am not authenticated and then send back to the login page.

Only after logging in can the contents of profile.html be show to me.

Right ?

But...

Let's say I have logged in.

In ChromeDevTools in the Network Tab I can select any request and copy it as curl, with all cookies.

I tried out that curl command in Bash, I saw that the page that was suppose to be loaded only after logging in, worked fine.

Is this how its suppose to work ?

Many sites like fmovies.to, sometimes have a pop-up that takes me to www.google.co.in. Now I keep my Google signed in in Chrome.

Does it mean I have been pwned ?

Or am I completely missing something obvious here ?

5
  • When you copy as curl, the cookies sent in the request are also copied. Which means the resulting curl request will also send the login cookie with it. The website will receive the login cookie and assume you are logged in. This is normal and expected.
    – nobody
    Commented Jun 13, 2021 at 20:21
  • @nobody Let's say I am on a website abc.com, if that website redirects me to google.com and I have my Google Account signed-in, won't they be able to steal my cookies and log into my Google Account ?
    – ng.newbie
    Commented Jun 14, 2021 at 11:13
  • No they won't. Your browser will only send the cookies to the domain(s) they belong to.
    – nobody
    Commented Jun 14, 2021 at 12:21
  • @nobody No way for Javascript to intercept the cookies the browser is sending ? I mean if I make a redirect from JavaScript there is no way for me to get the cookies supplied up by the browser ?
    – ng.newbie
    Commented Jun 14, 2021 at 17:42
  • 1
    No, there isn't. Google cookies are sent to google, there is no reason the browser would send them to a website they do not belong to, even if you are doing a redirect or whatever. And if the cookie is HTTP only (as it should be) then even javascript from google cannot access it, it is only sent in requests to google.com and nothing else.
    – nobody
    Commented Jun 14, 2021 at 17:53

1 Answer 1

1

For most websites, cookies are used to persist login information once the user has logged in. This prevents the user from needing to log in for every page they want to visit, and it's normal and expected that anyone who has access to that set of cookies will have normal access to that account for the lifetime of the session.

The fact that cookies are usually used to grant such access has led to several security measures to restrict their scope, such as restricting them to be able be accessed only for HTTP(S) requests or restricting them to secure contexts only (which usually means HTTPS only).

As nobody mentioned in the comments, the copy as curl copies all the cookies, which means that the curl requests will generally act the same way and with the same privileges as your logged in Chrome session. You are, effectively, logged in.

Cookies are generally persisted securely in the web browser, although some sites may wish to take measures against cookie theft, such as limiting cookie lifetimes, refreshing cookies frequently, or requiring confirmation of access (such as a password) before performing especially sensitive operations.

So this is normal and expected, although you have noted correctly that having the cookies for a site does grant you full access, which generally requires taking prudent security measures to prevent their compromise.

2
  • Let's say I am on a website abc.com, if that website redirects me to google.com and I have my Google Account signed-in, won't they be able to steal my cookies and log into my Google Account ?
    – ng.newbie
    Commented Jun 14, 2021 at 11:02
  • there are attacks that can be used to steal cookies cross-site, but browsers support "same-site" and "http-only" attributes for cookies now. This should prevent a site loading another site in a frame/iframe and attempting to steal the cookies via javascript. Commented Jun 14, 2021 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .