What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't serve up cookies from another domain to my website if it asks for them?

2 Answers 2


In short, guarantee that cookies from site A won't be read by site B is provided by so called Same Origin Policy (SOP). This is browser security implementation. Sure, if there is a place for code injection (like XSS), attacker can steal your cookies, but that's another scope - in that case client "allows" (but user is unaware) to retrieve cookies by third-party.

Additionally, I highly recommend to read Michal Zalewski's browser security book, or, at least chapter of it: http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookies. Also, nice post about cookies is again from himself: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design.html.

Some good, related to this question links from here: How can I check that my cookies are only sent over encrypted https and not http? and Are browser still vulnerable to Cross-Site Cooking?.

  • What if the browser doesn't implement SOP? (Also, you misspelled "third".)
    – Moshe
    Commented Nov 20, 2010 at 23:30
  • 1
    @Moshe, thanks, fixed. I would say that browser without SOP or it's any analogue security scope implementation is a bicycle without wheels.
    – anonymous
    Commented Nov 20, 2010 at 23:33
  • 2
    @Ams, actually it would be more like a bicycle without brakes. And all the current (popular) browsers do implement it, but of course there could always be bugs.
    – AviD
    Commented Nov 20, 2010 at 23:41
  • @AviD, right, that sounds better :)
    – anonymous
    Commented Nov 20, 2010 at 23:59

In addition to SOP cookies can be marked as HTTP Only which means Javascript can't access them, thus protecting them against XSS attacks and can also be marked as Secure which means they're only served over an HTTPS connection, protecting them from sniffing like Firesheep.

Of course all this relies on the browser getting it right, and in some cases supporting it. Safari for example didn't support HTTP Only cookies in its first couple of versions.

  • I think "In addition to SOP" is not suitable wording. Yes, those measures are provided by browser, but one is a scope integrity, others are route and data integrity. I suppose, author asked only about SOP. But addition is correct, it is just important to distinguish the levels of those security implementations.
    – anonymous
    Commented Nov 20, 2010 at 23:45
  • 2
    Well the question starts with "What protects cookies from being stolen?" So while SOP is mentioned specifically, HttpOnly/Secure does add to the first question
    – blowdart
    Commented Nov 21, 2010 at 5:08
  • 1
    "cookies can be marked as HTTP Only which means Javascript can't access them, thus protecting them against XSS attacks" Not really. (Actually, not at all.) HTTPOnly only prevents read access to the cookie in JS.
    – curiousguy
    Commented Nov 13, 2011 at 1:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .