The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
0
votes
1answer
86 views

Is it secure to use a hash of a login token as an anti-csrf token?

Alright here is my proposal: Use a hash of a login token as the anti-CSRF token. Why this is a good idea? Prevents having to store anything extra on the client, the server, and less network traffic ...
0
votes
1answer
41 views

Secure Cookie on HTTP site

I was asked this question "If the cookie is marked secure and the web application is over http , Cannot we access the application ?" Considering the secure flag is to ensure the cookie is sent only ...
0
votes
0answers
23 views

Setting cookies when client and server are hosted on different machines [on hold]

If an applications client and server are hosted on two different machines, will the server side be able to set cookies on the client side? Will CORS need to be implemented for setting cookies in this ...
0
votes
1answer
72 views

Crack a single http cookie and gain access to a random user's account!

I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
3
votes
1answer
71 views

Cookie without secure flag but with httponly

I have a cookie that is httponly but without the secure flag. Under this condition, can an attacker capture the cookie, although the site is only on HTTPS?
1
vote
1answer
40 views

Having problems with performing a JWT “none” algorithm attack

I'm taking a course where I must breach a site which uses 2015 version of JWT for authentication. They gave me the test//test login information and I must login with admin. After I log in, I receive ...
2
votes
0answers
62 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
0
votes
0answers
50 views

How to Stop Cookies from Being Set

We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
2
votes
1answer
121 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
0
votes
1answer
64 views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
1
vote
1answer
80 views

What can happen if my Flask SECRET_KEY becomes public?

I use OpenID Connect to let my users login. What could happen if Flasks SECRET_KEY becomes public?
1
vote
1answer
145 views

XSS in iframe can't access document cookies

I know of a website, lets call it website.com, that has these vulnerabilities: iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
1
vote
1answer
45 views

Reverse proxy isolation from insecure blog, are sessions vulnerable?

Hi I have a WebApp where security is important. E.g. www.somewebapp.com The app has a wordpress blog (hence not secure since wordpress). e.g. www.somewebapp.com/blog To protect the webapp from ...
1
vote
1answer
67 views

How to prevent security risk when logout failed for authentication cookies

In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected. But it seems that ...
0
votes
1answer
77 views

Cookie-Based Authentication Security of Popular Websites [closed]

Let's take Google and other popular bank websites which uses cookie. I've been working with a website using Angular which uses Laravel as an API. Data are stored in cookies which is vulnerable in ...
0
votes
2answers
76 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
1
vote
0answers
50 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
2
votes
1answer
95 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
0
votes
0answers
57 views

Is it secure to prevent CSRF in API without using CSRF cookie (only CSRF token sent in header of ajax requests)?

There is a standard method of preventing a CSRF attack by comparing a value in a special cookie (that is posted automatically with each request) and some value that is coming either in form post (from ...
1
vote
1answer
103 views

Why sign session cookies? [duplicate]

I'm using express-session middleware to store sessions on the server. The client's browser gets a cookie with the session ID. A secret is required in the configuration; it is used to sign the session ...
0
votes
1answer
34 views

Is it possible to infer advanced cookie properties like expiration from Wireshark

I want to perform a cookie injection attack for demonstration purposes. I could achieve this using Firefox Cookie-Editor extension. However, the attack can only succeed if I enter the cookie name, ...
0
votes
1answer
96 views

How to stop other programs from reading passwords stored in my browser?

I was very surprised and alarmed to see that a free software could list passwords stored by browser in plain text. I thought that these passwords (such as the ones for email) are encrypted and can't ...
0
votes
2answers
86 views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
0
votes
0answers
76 views

Does copying cookies from one pc to other makes Gmail believe that the other device is not a new device login?

Each time I login into a new device either Gmail or Facebook login, it send a notification to my mobile saying a login is detected in a new device stating the device name or OS name. I am curious to ...
0
votes
1answer
41 views

Cancelling a request stops new authentication cookie getting to browser, invalidating all further requests

I am trying to secure my login system using authentication cookies. If the user tries to access a protected resource they must provide an authentication cookie. If the cookie is valid, the request is ...
1
vote
1answer
106 views

How does SameSite cookie header prevent tracking?

I understand how SameSite cookie header prevents CSRF. But how does it prevent tracking by 3rd party sites, since they could set SameSite=Lax or None, and the browser will still send them: https://web....
0
votes
1answer
112 views

Are subdomains secure from one another if they are on separate servers?

I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com). Each user application will be run on separate servers ...
2
votes
1answer
79 views

When using a shared / public VPN, can others on the same IP address log into your accounts?

I know browsers use cookies so that, for example, if I log into Facebook on a public computer and forget to log out, the next person who opens up a new browser can go into my account. Does this work ...
0
votes
2answers
332 views

Delete secure cookie using javascript

After reading some responses here and in other sites, I am a bit confused if a secure cookie (not httponly) can be deleted in client side using js. for example, @8zero2-ops says that there is no ...
0
votes
0answers
56 views

Why is it wise, from a security POV to have sessions expire? [duplicate]

It is a common practice to have sessions expire for users when they are logged in for a long period, especially if they are inactive. I've seen this particularly employed in systems where sensitive ...
60
votes
5answers
8k views

What are the risks of just clearing cookies instead of logging off?

A typical web authentication workflow looks like this: User provides their credentials. Server validates credentials. If credentials are valid Server generates a token. Server keeps this token. ...
-1
votes
2answers
94 views

CDN change for “enhanced security”? (now uses cookies)

For the past few months, I've been unable to continue a particular course on udemy. I can access all other video courses accept that particular course and their support has answered "We recently ...
2
votes
3answers
514 views

Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?

ASP.NET documentation says: FormsAuthentication.SignOut() Removes the forms-authentication ticket from the browser Why is the cookie not invalidated at the server as well? It would be easy ...
1
vote
2answers
127 views

What is advantage of passing request / response data via cookies instead of regular query parameters?

I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (...
2
votes
3answers
517 views

is having a `set-cookie: sessionid=xxxxxxx` in every response considered bad practice?

My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ...
-1
votes
2answers
301 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
0
votes
1answer
302 views

How can I inject cookie from Wireshark into a browser sesson [duplicate]

For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password). I collected traffic during a login ...
4
votes
1answer
74 views

Plausible scenario for a PHP session fixation attack with default settings?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings. Given session....
0
votes
1answer
287 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
1
vote
2answers
107 views

Is it imporant that a cookie should have secure flag set if the website is running on HTTP?

I am working on a website and I want to know if a cookie needs to have a secure flag set or not if the website is running on HTTP. Also, httponly flag is set on cookie but there is no secure flag.
0
votes
0answers
61 views

Who / what has access to delete cookies?

I'm experiencing an odd issue lately where I'm frequently being logged out of YouTube, but not from other Google services. Upon further investigation, it looks like the SID cookie which is used to ...
0
votes
1answer
143 views

How to do authentication when FE and BE are on different domains?

We're doing authentication by sending a JWT via an httpOnly cookie. (client sends credentials, server answers with a token cookie, client attaches it to all subsequent requests). Due to some ...
1
vote
1answer
275 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
0
votes
0answers
65 views

How does the Brave browser protect against sites that a person has already logged into?

I understand that the Brave browser does not allow for 3rd party cookies to be set so that a user will not be tracked by a 3rd party site. However if I were to log into a site like Facebook and ...
3
votes
2answers
553 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
0
votes
2answers
118 views

Cookie generation

What is the most secure was to generate cookies that makes it hard for a user to be able to guess the session cookie of another particular user or that will be accepted as a valid session cookie. ...
2
votes
1answer
295 views

Can an XSS exploit on a subdomain steal the cookies of the parent domain?

As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its ...
0
votes
1answer
60 views

Would cookie always change when browser changes?

I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it'...
1
vote
0answers
272 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
2answers
59 views

3rd Party trackers and online privacy

I don't feel the internet is respecting our individual right to privacy. Why are 3rd party trackers allowed to siphon data from us without our permission? We should selectively be able to reveal what ...