Questions tagged [cookies]
A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.
820
questions
1
vote
1
answer
86
views
Does not storing passwords in browser really matter given cookie hijacking exists?
I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too.
But then I found out about ...
0
votes
1
answer
67
views
token leak by copying cookie
Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
0
votes
1
answer
85
views
Authentication that immune to cookie hijacking [duplicate]
There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability.
...
- 423
0
votes
0
answers
59
views
do I need anti-csrf-tokens or double submit cookie pattern?
currently I'm working on a NestJs backend. I have already implemented the auth feature with jwt (access and refresh) stored in cookies. Originally I sent the jwt by the standard Bearer token way in ...
- 101
0
votes
1
answer
167
views
Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?
Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
- 131
0
votes
1
answer
89
views
Is using two cookies one Lax and one Strict a way to improve usability without compromising security?
My understanding is that
Strict is the best as, admitting you have a recent browser, it completely replaces the need for CSRF Token.
Strict is however a big hit on usability as things like SSO or ...
- 103
1
vote
0
answers
91
views
How to ignore asterisk characters in sqlmap?
I've come across a webpage that uses Iron cookies. These cookies have the exemplary format: Fe26.2**0cdd607945dd1dffb7da0b0bf5f1a7daa6218cbae14cac51dcbd91fb077aeb5b*aOZLCKLhCt0D5IU1qLTtYw*...
- 11
0
votes
2
answers
88
views
Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?
When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
- 1
0
votes
1
answer
34
views
How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?
When a user logs in with their email/password combo and gets authenticated to our website, the backend sends the web browser an encrypted cookie based off of their memberId with us. While this ...
- 295
1
vote
1
answer
128
views
What sort of cookie is this website giving users
I am doing some research into scam websites (particularly the ones where you receive a text message telling you you have an undelivered package, or unpaid tolls etc and they provide you with a link to ...
- 71
0
votes
1
answer
307
views
Identifying a session hijacking attack [closed]
I understand session hijacking has been a widespread attack vector in the past months.
If an attacker steals a user’s session cookies, they can bypass 2FA and login/password.
If this is the case, how ...
- 3
0
votes
0
answers
1k
views
Decrypting Browser Cookies
So I am trying to write my own backdoor with python and it is something like Metaploit, where you can run a single command and it would do the work for you, so I am trying to implement a cookie ...
0
votes
1
answer
245
views
How does reddit maintain visit history after clearing cache, cookies and de-fingerprinting?
Setup: I clear cache and history in firefox, then visit reddit.com in a private window and browse/read three very specific subreddits while NOT logged in. Then, I close that private window entirely ...
- 201
2
votes
1
answer
154
views
Should I return JWT tokens on a login route even if I am using cookies?
I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to ...
- 21
0
votes
1
answer
2k
views
Where to store JWT refresh tokens
Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
0
votes
1
answer
57
views
Passing user identity to a different REST service
I have two use-cases I am trying to solve.
A HTTP Service-A hosted on XYZ domain tries to access HTTP Service-B on ABC domain. Service-B is a stateless HTTP API which does not have user concept. ...
- 101
1
vote
1
answer
246
views
AES ECB cookie bypass
I am currently participating in a CTF Challenge and have reached a stage where I discovered a "log_admin" page. This page generates a cookie that is encrypted using AES 128 ECB. I obtained ...
- 11
1
vote
0
answers
87
views
SSO Using API based login (not through UI redirection)
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. ...
- 283
1
vote
1
answer
4k
views
Set cookie inside iFrame domain not seen
I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
- 11
0
votes
0
answers
49
views
Options for various auth strategies for express API
OK, I need some help with this:
I am creating a Node express API, and I want to support the following auth strategies:
Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for ...
- 227
0
votes
1
answer
113
views
How does Android/Firefox authenticate the Android Pocket app, for example?
I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. ...
- 649
2
votes
1
answer
197
views
Logout is just clearing cookies [closed]
My friend who is a web developer implemented his session management in a totally new way for me.
He created a random sessionAPPID that is given to the user when he gives correct credentials.
He then ...
- 73
0
votes
0
answers
517
views
best way to keep user logged in with cookie and jwt?
I'm making an SPA with Laravel REST API and trying to keep it stateless.
Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality.
On successful login the client ...
- 11
1
vote
1
answer
364
views
How to implement Double Submit Cookie with Encryption or HMAC
I'm trying to implement the Double Submit Cookie pattern with extra protection using encrypted or signed CSRF tokens. I'm working with a Single Page Application and a stateless API. The purpose of ...
- 111
0
votes
1
answer
203
views
Google Security Cookies; Prevents cookie leak to malicious XHRs
Below is an excerpt from https://policies.google.com/technologies/cookies#security
The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a
browsing session are made by the user, and not ...
0
votes
1
answer
61
views
Why does a page opened via https send an http cookie when I log in? [closed]
I use Brave browser with VPN, I also set it to only allow https. When I log in to my Gmail account, I see http cookies in the security part of the Brave browser. As far as I know, http cookies are not ...
- 3
1
vote
0
answers
149
views
How does a website know if i've visited it before? (and how to bypass that) [closed]
For example: https://pdfcandy.com/pdf-ocr.html has a limit on how many times I can use a feature per hour, but if I use an incognito tab I can easily bypass that.
But with https://ichigoreader.com/...
- 11
0
votes
3
answers
247
views
Do browser vendors have access to LocalStorage/cookies?
Question is pretty much in the title. We have a customer that is very concerned with privacy, and we're making a solution that will rely on data being stored in LocalStorage, so we just need to verify ...
- 103
1
vote
0
answers
76
views
Storing auth token in html
Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
- 11
2
votes
1
answer
566
views
Is it possible to steal a cookie without HttpOnly via CSRF?
Without giving too many details away, let's say that I'm auditing an API that:
Has access-control-allow-credentials: true
Has access-control-allow-origin: *
Needs JWT set in Authorization header for ...
- 35
2
votes
1
answer
457
views
Cookie flow in a site that hosts embedded Youtube video
When there's a Youtube video embedded on a site that I visit while I am logged in Youtube beforehand,how does the embedded video know that it's me so I can add it to my Watch Later list?
I think the ...
- 2,493
2
votes
0
answers
59
views
Auth Token not included in CORS exploit [closed]
I have found a CORS on a website but when I am trying to exploit it for a POC it is fetching all the cookies except auth cookies and due to that I am getting an error message to "User not logged ...
1
vote
2
answers
188
views
Are there any security reasons against "drop-www" (using example.com instead of www.example.com)?
Are there any security reasons against "drop-www"?
In other words, are there any security reasons against using an apex [1] domain name such as example.com instead of a subdomain such as www....
- 744
1
vote
1
answer
137
views
Can websites, through cookies or other usual means, access PDFs opened in browser?
Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
0
votes
0
answers
32
views
Session verifier giving access to the login action
I have an web app that provides login page. User can use this login page while he has valid session verifier in cookie. Full flow looks like this:
User is redirected with some code in query param to ...
- 309
1
vote
1
answer
707
views
For cookie containing access_token, setting secure = false, is that bad practice? Even if signed with jwt?
I'm using a server side rendering JS framework where the user signs into auth0, the client server then receives the access_token, uses jwt to sign it with our private key, and sends it to the client ...
- 11
0
votes
1
answer
157
views
How easy is it really for malicious websites to steal session cookies or other data?
I would like to know how feasible an attack on a web browser is. Is that something that occurs frequently or is it difficult to manage for a malicious website to steal sensitive data using remote code ...
- 31
2
votes
2
answers
1k
views
If browser cookies aren't shared between different websites, then why is Same origin Policy useful?
I'm a beginner to Web security and I recently started reading about Same Origin Policy and it's usefulness in preventing a malicious website from interacting with a secure website being used by a user....
- 21
1
vote
1
answer
3k
views
Why do big sites use cookies and not OpenID connect?
As I understand it, OAuth is the natural evolution of authentication protocols
I understand in a general way that evolution is as follows:
basic authentication
cookies
tokens, at this point you want ...
- 177
0
votes
1
answer
609
views
Is the .AspNet.Application cookie vulnerable to CSRF attacks?
I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability.
The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict:
protected void ...
1
vote
1
answer
812
views
What are the security issues with setting cookies for subdomains?
Everywhere I look, I only find explanations as to who can set who's cookies and who can access the cookies of whom.
Why do we need these restrictions?
More precisely:
Why is it OK for a subdomain to ...
- 123
0
votes
0
answers
51
views
Security of the not transmitted cookie
If I have session cookie or just cookie which is Secure, HttpOnly with SameSite=Strict and is never transmitted even in requests within the same domain and the page uses TLS.
Is there any attack that ...
- 309
1
vote
2
answers
394
views
How are advertisements through Facebook targeting me moments after searching on a different computer
When connected to my home network, I only use the Facebook app on my phone. I never log into Facebook via a browser on my laptop or other computer connected to my home network.
How is it possible that ...
- 267
0
votes
1
answer
45
views
Do I need to set up super global SESSION for a web form?
I am building a web form in PHP, is just for the user to request information about my services or send comments, so I don‘t need the user to be logged with a username and a password, no databse. I ...
- 1
3
votes
1
answer
2k
views
Does Cache-Control: no-cache="Set-Cookie, Set-Cookie2" actually prevent caching cookies?
This OWASP recommendation says:
it is highly recommended to use the Cache-Control: no-cache="Set-Cookie, Set-Cookie2" directive, to allow web clients to cache everything except the session ...
- 103
0
votes
1
answer
386
views
portswigger Lab - Reflected XSS into HTML context with most tags and attributes blocked
I am busy with the portswigger lab studies, doing "Reflected XSS into HTML context with most tags and attributes blocked".
I successfully fire the print() on myself and the simulated victim, ...
- 1
2
votes
2
answers
2k
views
How to access CSRF token in fronted when API is on different domain?
I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection.
Now the problem is that the CSRF token is being set on the client side as a cookie on ...
- 23
0
votes
1
answer
496
views
Validating CSRF state with an OAuth2 POST Callback
I am setting up OAuth2 for Apple, and it requires a POST response to the callback URL if certain scopes (e.g. email address) are included.
My intended process for preventing CSRF:
Set a cookie with a ...
0
votes
1
answer
356
views
I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?
What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
0
votes
1
answer
155
views
Session cookie security
I am creating a small login system. It looks like the standard username/pwd and user can either log or register.
If they pass (authenticate), I create a session cookie that will be sent with the ...
- 25