Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
2
votes
0answers
34 views

Is the “same registrable domain” a sound security basis for cookies?

Unlike other Web standards, HTTP cookies don't use the common definition of the "origin" as with the "same origin policy"; cookies are segregated by domain names and subdomains. (And there is the ...
1
vote
2answers
79 views

Session ID containing username?

Is it safe to append the user's username to the session ID? The session ID is 32 bytes long generated using a secure PRNG. I encode it using base64 URL to save it in a HttpOnly cookie. The cookie ...
0
votes
1answer
68 views

Privilege escalation modifying cookie

I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...
0
votes
0answers
57 views

Cookie not invalidated when I close my browser [closed]

Is it a vulnerability when the cookie is not invalidated when I close my browser?
1
vote
0answers
38 views

Hardening ASP.NET against session fixation: Should I change the session ID despite the additional Auth cookie?

Situation I am the responsible developer for an ASP.NET application that uses the "Membership" (username and password) authentication scheme. I am presented with the following report from a ...
0
votes
2answers
109 views

Baking a better cookie - How can we prevent a high-jacking of the user's local cookie file to exploit accepted cookie use?

This question is similar to Hashing cookie-values & preventing cookie-stealing however, it is significantly different as I am interested in preventing (internal) subscription fraud, rather than an ...
0
votes
1answer
47 views

Exploiting CORS and storing the response to server

I am trying to exploit misconfiguration CORS. I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the ...
81
votes
5answers
15k views

How does Facebook track your browsing without third party cookies?

Facebook has served me an ad for a website I visited earlier in the day. I have third party cookies disabled and have not followed any links between the website and Facebook (links which could contain ...
1
vote
0answers
39 views

What relative functionality needs to be implemented when users click an “Accept Cookies” button? [closed]

As of 2018, a recent security measure was passed, called 'The Cookie Law'. It states that; if you have a website or blog with visitors from the EU (which is likely to happen), "you need a cookie ...
0
votes
0answers
34 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
1
vote
1answer
85 views

Preventing CSRF with SameSite=“strict” without degrading user experience?

ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks: https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
2
votes
1answer
115 views

Security Risk of Stolen Session ID vs Authentication Token

I was intrigued by the discussion of this SO question as well as the accompanying blog post. I'm trying to better understand the mechanics of the two systems, and one of the questions I came up with ...
0
votes
0answers
17 views

Intra-domain Session Management Using Cookie

I need some guidance on a solution I am building. I have a mega/super domain (e.g. .example.com). I need the users to be able to log into a subdomain (e.g. central.example.com) and maintain their ...
0
votes
0answers
68 views

Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution

I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
0
votes
1answer
111 views

Is it secure to use a hash of a login token as an anti-csrf token?

Alright here is my proposal: Use a hash of a login token as the anti-CSRF token. Why this is a good idea? Prevents having to store anything extra on the client, the server, and less network traffic ...
0
votes
1answer
52 views

Secure Cookie on HTTP site

I was asked this question "If the cookie is marked secure and the web application is over http , Cannot we access the application ?" Considering the secure flag is to ensure the cookie is sent only ...
0
votes
1answer
82 views

Crack a single http cookie and gain access to a random user's account! [duplicate]

I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
3
votes
1answer
79 views

Cookie without secure flag but with httponly

I have a cookie that is httponly but without the secure flag. Under this condition, can an attacker capture the cookie, although the site is only on HTTPS?
1
vote
1answer
57 views

Having problems with performing a JWT “none” algorithm attack

I'm taking a course where I must breach a site which uses 2015 version of JWT for authentication. They gave me the test//test login information and I must login with admin. After I log in, I receive ...
2
votes
0answers
77 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
0
votes
0answers
53 views

How to Stop Cookies from Being Set

We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
2
votes
1answer
130 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
0
votes
1answer
76 views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
1
vote
1answer
86 views

What can happen if my Flask SECRET_KEY becomes public?

I use OpenID Connect to let my users login. What could happen if Flasks SECRET_KEY becomes public?
1
vote
1answer
282 views

XSS in iframe can't access document cookies

I know of a website, lets call it website.com, that has these vulnerabilities: iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
1
vote
1answer
47 views

Reverse proxy isolation from insecure blog, are sessions vulnerable?

Hi I have a WebApp where security is important. E.g. www.somewebapp.com The app has a wordpress blog (hence not secure since wordpress). e.g. www.somewebapp.com/blog To protect the webapp from ...
1
vote
1answer
75 views

How to prevent security risk when logout failed for authentication cookies

In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected. But it seems that ...
0
votes
1answer
84 views

Cookie-Based Authentication Security of Popular Websites [closed]

Let's take Google and other popular bank websites which uses cookie. I've been working with a website using Angular which uses Laravel as an API. Data are stored in cookies which is vulnerable in ...
0
votes
2answers
83 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
1
vote
0answers
50 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
2
votes
1answer
97 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
0
votes
0answers
61 views

Is it secure to prevent CSRF in API without using CSRF cookie (only CSRF token sent in header of ajax requests)?

There is a standard method of preventing a CSRF attack by comparing a value in a special cookie (that is posted automatically with each request) and some value that is coming either in form post (from ...
1
vote
1answer
122 views

Why sign session cookies? [duplicate]

I'm using express-session middleware to store sessions on the server. The client's browser gets a cookie with the session ID. A secret is required in the configuration; it is used to sign the session ...
0
votes
1answer
34 views

Is it possible to infer advanced cookie properties like expiration from Wireshark

I want to perform a cookie injection attack for demonstration purposes. I could achieve this using Firefox Cookie-Editor extension. However, the attack can only succeed if I enter the cookie name, ...
0
votes
1answer
97 views

How to stop other programs from reading passwords stored in my browser?

I was very surprised and alarmed to see that a free software could list passwords stored by browser in plain text. I thought that these passwords (such as the ones for email) are encrypted and can't ...
0
votes
2answers
210 views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
0
votes
0answers
85 views

Does copying cookies from one pc to other makes Gmail believe that the other device is not a new device login?

Each time I login into a new device either Gmail or Facebook login, it send a notification to my mobile saying a login is detected in a new device stating the device name or OS name. I am curious to ...
0
votes
1answer
42 views

Cancelling a request stops new authentication cookie getting to browser, invalidating all further requests

I am trying to secure my login system using authentication cookies. If the user tries to access a protected resource they must provide an authentication cookie. If the cookie is valid, the request is ...
1
vote
1answer
245 views

How does SameSite cookie header prevent tracking?

I understand how SameSite cookie header prevents CSRF. But how does it prevent tracking by 3rd party sites, since they could set SameSite=Lax or None, and the browser will still send them: https://web....
1
vote
2answers
178 views

Are subdomains secure from one another if they are on separate servers?

I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com). Each user application will be run on separate servers ...
2
votes
1answer
89 views

When using a shared / public VPN, can others on the same IP address log into your accounts?

I know browsers use cookies so that, for example, if I log into Facebook on a public computer and forget to log out, the next person who opens up a new browser can go into my account. Does this work ...
1
vote
2answers
643 views

Delete secure cookie using javascript

After reading some responses here and in other sites, I am a bit confused if a secure cookie (not httponly) can be deleted in client side using js. for example, @8zero2-ops says that there is no ...
0
votes
0answers
56 views

Why is it wise, from a security POV to have sessions expire? [duplicate]

It is a common practice to have sessions expire for users when they are logged in for a long period, especially if they are inactive. I've seen this particularly employed in systems where sensitive ...
61
votes
5answers
9k views

What are the risks of just clearing cookies instead of logging off?

A typical web authentication workflow looks like this: User provides their credentials. Server validates credentials. If credentials are valid Server generates a token. Server keeps this token. ...
-1
votes
2answers
94 views

CDN change for “enhanced security”? (now uses cookies)

For the past few months, I've been unable to continue a particular course on udemy. I can access all other video courses accept that particular course and their support has answered "We recently ...
2
votes
3answers
712 views

Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?

ASP.NET documentation says: FormsAuthentication.SignOut() Removes the forms-authentication ticket from the browser Why is the cookie not invalidated at the server as well? It would be easy ...
1
vote
2answers
130 views

What is advantage of passing request / response data via cookies instead of regular query parameters?

I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (...
2
votes
3answers
758 views

is having a `set-cookie: sessionid=xxxxxxx` in every response considered bad practice?

My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ...
-1
votes
2answers
339 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
1
vote
1answer
455 views

How can I inject cookie from Wireshark into a browser sesson [duplicate]

For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password). I collected traffic during a login ...