Can someone explain to me what cookie tossing is? and how it can be used to hijack someone's session? and also how can we prevent it? I am a bit confused about this subject.

  • Facetious Cookie tossing is being sick. By being sick on someone whilst they are in an active session they will often leave the computer unattended without logging out, allowing for session hijacking. This can be prevented by having a proximity token to access the computer. Preferably the screen would darken immediately on loss of connection to the token. – jhoyla Sep 17 '14 at 22:02

Cookie tossing is an attack which abuses the feature that a subdomain can put a key=value pair in a cookies which can then also be read by the domain above it. For example, when security.stackexchange.com sets a cookie, stackexchange.com will be able to read it. Unfortunately there is no way for stackexchange.com to see if the key=value pair comes from stackexchange.com or from security.stackexchange.com. So when stackexchange.com uses the same key for some of its own functionality, it might mistake the value from the subdomain for its own value and treat it as if it set it itself.

This becomes problematic when a website allows untrusted people to host subdomains under its domain. They can then abuse this feature to write manipulated cookie information. The ability to take over a session this way is limited, because the attacker can only write information, not read anything. However, setting arbitrary cookie values can in some cases be used for a CSRF attack or an XSS injection, depending on what the main domain does with the content of the cookie.

Protecting your website from this is easy: When you use cookies for anything on your main domain, don't let anyone you don't trust put their content on your subdomains.

  • 2
    It would be more accurate to say that security.stackexchange.com can set a cookie which can then be read by the domain above it. It can also set cookies that are specific to the security.stackexchange.com subdomain. Note that browsers have specific protections against a website setting a cookie on a top-level domain like "com", or an effectively top-level domain like "co.uk". – Mark Sep 17 '14 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.