1

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites.

In each request the server sends a Set-Cookie that sets a new session cookie that is used by the browser in the next request... This mechanism is supposed to reduce the risk of cookie theft. I suppose that it does not protect the cookie theft completely because if you steal the cookie before the user uses it, you can use it one time and get the new set-cookie...but it is more difficult for an attacker to use it.

Does it have sense? It is a valid mechanism to avoid cookie theft?

  • Could you tell us what website you are looking at? That may help. – bradreaves May 5 '14 at 13:48
  • It's confidential but I can be more specific and resolve any doubt about the case if you need. Just ask and I'll try. – kinunt May 5 '14 at 13:49
1

There was a paper a few years ago called "One-Time cookies:Preventing Session Hijacking Attacks with Stateless Authentication Tokens," but that implementation used X-OTC HTTP extension headers and had a lot of crypto under the hood. What you are seeing sounds like something different, though.

https://smartech.gatech.edu/bitstream/handle/1853/42609/GT-CS-12-02.pdf?sequence=1

  • I think that the policy of Information Security SE is to write down here the answer to the question and avoid just referencing but thanks for the information :) – kinunt May 5 '14 at 14:25
1

Yes, it has sense. The idea of one time cookies is to prevent attacks such as session hijacking.

For example, this paper (@bgt421 pointed to this paper in another answer) implements one time cookies by signing each user request with a session secret securely stored in the browser.

In fact, the paper above defends that its OTC cookies are not vulnerable to a series of threats:

enter image description here

It seems that the main problem of these mechanisms is that they require a lot of resources for mantaining the state synchronization in the web application.

  • I have answered my own question using paper that @bgt421 posted just in case it is useful for other people. – kinunt May 5 '14 at 15:30
0

It won't prevent theft, but changing the cookie does mean that if a cookie is stolen, then the user becomes aware of it quickly and can log in again (which will most likely invalidate their other session.)

If you can't prevent something from occurring, increasing the ability to detect it quickly is the next best thing. It won't help any if the cookie is stolen when the user is done with their session, but it is better than nothing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.