0

Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged into my own account. However, how could this be harmful? In what ways could someone exploit this to take over my account? What types of attacks could be carried out, and how can one protect against them?

I'm reading articles and watching videos on the same topic, but most of them are overly extensive and tend to be more convoluted than informative about the subject.

10
  • What's the "token" for?
    – schroeder
    Nov 13, 2023 at 16:34
  • "If I were to take this exact token and use it in another web browser, I would be logged into my own account." - so, if I took the token, I would be logged in as you?
    – schroeder
    Nov 13, 2023 at 16:34
  • cheatsheetseries.owasp.org/cheatsheets/…
    – schroeder
    Nov 13, 2023 at 16:36
  • 1
    doesn't " I have a website where the token is stored in cookies without any session validation." mean your token has no value... since no session validation also means no session which means you can't log in (or out) since no state... or am i missing something?
    – LvB
    Nov 13, 2023 at 16:38
  • 1
    Exactly my point... by being "loose" the question became nonsencical... My goal was to get @OP to be more exact in what he wants to know... this is SE after all... we are also missing what does having acces mean... There is a good and valid question possible here... its just net here yet... (or in other words, I am trying to refine this carbon to a diamond)
    – LvB
    Nov 13, 2023 at 17:00

1 Answer 1

0

If I were to take this exact token and use it in another web browser, I would be logged into my own account.

And this would not only be true to you, but also for the attacker.

However, how could this be harmful? In what ways could someone exploit this to take over my account? What types of attacks could be carried out, ...

The attacker could simply do everything you could do when being logged in and when no additional authentication (which the attacker does not have) is required. This means if you are logged into some shop, the attacker can buy things. If it is possible to specific a shipping address the attacker could ship something to themselves. So far this is not taking over the account but just misusing it, which is already pretty bad.

But, if the attacker would be able to change password reset email or maybe the password without further authentication then they could basically take the account away from you, so that they have access but you don't.

Of course, for this the attacker needs to be access to the cookie in the first place. There are various methods this can happen: vulnerability (XSS) in the site which exposes the cookie, insecure transport connection (i.e. no secure HTTPS), compromised end user device, ...

... and how can one protect against them?

You need to make sure that the attacker does not get access to the cookie. Therefore make sure do use HTTPS, don't just ignore browser warnings regarding invalid certificates, keep your system safe by following common recommendations for cyber hygiene etc.

Note that this does not protect against bugs in the application which allow the attacker to steal the cookie though. But you could limit some impact by using ad-blocking to prevent malicious ads from exploiting the bugs. It is also useful to time limit the exposure of the cookie by using incognito mode to visit the site and closing it after you are done - this will cleanup any local storage of cookies too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .