Questions tagged [cookies]
A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.
842
questions
0
votes
1
answer
24
views
Understanding Cross-Domain Cookies and `SameSite` Attributes with Express.js and Third-Party Tracking
What I have understood (I guess):
Cross-origin Cookies:
Cookies set with Domain="example.com" are not sent with fetch requests from origins like hello.example2.com to mywebsite.example.com ...
- 129
1
vote
1
answer
74
views
Is there an equivalent to passkeys but to prevent cookie stealing?
Passkeys prevent phishing, no one can make you login remotely (without exploits) and if they are hardware based and never leave the hardware, them even exploits might have a hard time getting them.
...
- 375
0
votes
0
answers
28
views
cant set cookie from request to another domain, chrome third party cookies phaseout
I am doing the PortSwigger CSRF lab, where the token is tied to a non-session cookie, the solution to this is that we set a cookie to the users' browser through the search field which sets the search ...
3
votes
1
answer
204
views
CORS credentials option set to true
To allow cookies to be sent to my ExpressJS server,credentials: true has to be set in my CORS config.
What potential security risks/ vulnerabilities could arise from this configuration?
If possible, ...
- 73
1
vote
2
answers
202
views
CSRF Prevention Using Signed Cookies And Custom Headers
Recently I was reading about CSRF prevention techniques like Synchronizer Token, Cookie-to-header, and Double Submit Cookie. Cookie-to-header is good for websites using a lot of JavaScript, e.g. SPAs, ...
- 13
0
votes
1
answer
120
views
What are the consequences of cookies, including the session cookie, being stolen?
I have recently been wondering what the consequences would be if an attacker got access to a user’s cookies, including the session cookie, for my web app?
Could they impersonate said user?
Could they ...
- 1,414
0
votes
1
answer
54
views
Running blog under /blog, security considerations
I'd like to set up a self-hosted Ghost.org blog for a SaaS. I have two options:
example.com/blog
blog.example.com
Everywhere I read they recommend the /blog for SEO. However, I'm concerned about the ...
- 101
1
vote
0
answers
70
views
Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation
I have a website that includes CSP rules:
.use(
helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["'self'"],
scriptSrc: [
"'self'",
"cdnjs....
- 13
0
votes
0
answers
291
views
httpOnly Session Cookies in an iframe context in the future w/o SameSite=None
My website is using session cookies (w/ SameSite=Lax, secure, httpOnly attributes) and a CSRF Token stored in localStorage. Recently I developed a teams app, which essentially loads the website ...
0
votes
1
answer
128
views
Is it possible to trick a user into logging in to a site, then stealing a non HttpOnly cookie that will be set after they log in?
If a user has already logged in, and then the site sets a non HttpOnly cookie, then it seems possible to trick the user into doing something that would lead to the cookie being stolen.
If the cookie ...
- 11
0
votes
1
answer
150
views
how to send cookies or token in local storage to a remote server using reflected XSS
I have an XSS vulnerability identified by <script>alert(1);</script> in the url.
So when I put it in the url it gets executed (ex: www.example.com/admin/<script>alert(1);</script&...
- 97
2
votes
1
answer
190
views
Does saving the cookie or jwt token in the browser raise a security risk?
I have an admin screen, once I access it, it asks for login credentials, then after I login, I get a token that is saved under local storage (see screenshot below)
Noting that I am using edge browser ...
- 97
0
votes
1
answer
845
views
Secure access and refresh token handling in a SPA
I am trying to figure out how to handle access and refresh tokens securely on the front end in a SPA. After doing a lot of reading, I still have questions/doubts about the proposed solutions I found ...
- 1
1
vote
0
answers
199
views
Session/cookie expire time, match access token or refresh token from AD?
I am tasked with moving away from implicit flow in a SPA. It is a basic solution consisting of a react SPA and a .net API, on the same domain. This web app is a case management solution that deals ...
- 113
0
votes
0
answers
542
views
Lax SameSite and POST (2 minute)
I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has ...
- 183
0
votes
1
answer
191
views
Double Submit Cookie Bypass
I am trying to work on an example for my class on how double submit cookie works and how attackers can bypass it
The idea i have is I have two domain att.com and victim.com. The login functionality on ...
- 183
4
votes
2
answers
1k
views
HTTPonly token without CSRF is safe?
How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible?
for example, to be ...
- 43
2
votes
0
answers
208
views
Storing bearer token in cookie for file retrieval in another tab
The existing system involves storing the bearer token in a cookie to fulfill a customer request of not only downloading an attachment within the application but also opening it in another tab. This is ...
- 121
7
votes
3
answers
2k
views
Is storing authentication tokens in local storage with a strong CSP safe?
Whenever the topic comes up, almost every source recommends to never store authentication tokens in a place where they can be accessed by client-side Javascript. The recommendation is almost always to ...
- 891
1
vote
1
answer
115
views
Why wouldn't a site's cookies be sent in this scenario?
I'm reading an article on Okta's engineering blog, which contains the following paragraph:
Some of the disadvantages of cookies include:
Cross-site request forgery attacks (XSRF or CSRF): CSRF ...
- 113
0
votes
2
answers
409
views
What are Cookies SQL injection?
After applying web vulnerability scan on a site that I have, I found a vulnerability called Cookie SQL injection, and applied on the requested cookie.
What is this vulnerability? and how can I solve ...
Yara Sholi
1
vote
1
answer
493
views
Is prohibiting cookies a viable CORS alternative?
I have been using lots of various APIs in my frontend lately and they all have to be properly configured with CORS and the browser always do extra OPTIONS request that only make debugging harder.
I ...
- 2,287
3
votes
1
answer
780
views
OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header
I'm exploring the possibility of implementing OpenID Connect (OIDC) with an HTTP-only cookie to keep my frontend code completely authentication-agnostic, instead of passing the Authorization header ...
- 131
2
votes
1
answer
193
views
Does not storing passwords in browser really matter given cookie hijacking exists?
I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too.
But then I found out about ...
0
votes
1
answer
168
views
token leak by copying cookie
Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
0
votes
1
answer
140
views
Authentication that immune to cookie hijacking [duplicate]
There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability.
...
- 423
0
votes
0
answers
228
views
do I need anti-csrf-tokens or double submit cookie pattern?
currently I'm working on a NestJs backend. I have already implemented the auth feature with jwt (access and refresh) stored in cookies. Originally I sent the jwt by the standard Bearer token way in ...
- 101
1
vote
1
answer
1k
views
Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?
Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
- 141
0
votes
1
answer
219
views
Is using two cookies one Lax and one Strict a way to improve usability without compromising security?
My understanding is that
Strict is the best as, admitting you have a recent browser, it completely replaces the need for CSRF Token.
Strict is however a big hit on usability as things like SSO or ...
- 103
1
vote
0
answers
282
views
How to ignore asterisk characters in sqlmap?
I've come across a webpage that uses Iron cookies. These cookies have the exemplary format: Fe26.2**0cdd607945dd1dffb7da0b0bf5f1a7daa6218cbae14cac51dcbd91fb077aeb5b*aOZLCKLhCt0D5IU1qLTtYw*...
- 11
0
votes
2
answers
198
views
Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?
When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
- 1
0
votes
1
answer
154
views
How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?
When a user logs in with their email/password combo and gets authenticated to our website, the backend sends the web browser an encrypted cookie based off of their memberId with us. While this ...
- 307
1
vote
1
answer
305
views
What sort of cookie is this website giving users
I am doing some research into scam websites (particularly the ones where you receive a text message telling you you have an undelivered package, or unpaid tolls etc and they provide you with a link to ...
- 303
0
votes
1
answer
1k
views
Identifying a session hijacking attack [closed]
I understand session hijacking has been a widespread attack vector in the past months.
If an attacker steals a user’s session cookies, they can bypass 2FA and login/password.
If this is the case, how ...
- 3
0
votes
0
answers
4k
views
Decrypting Browser Cookies
So I am trying to write my own backdoor with python and it is something like Metaploit, where you can run a single command and it would do the work for you, so I am trying to implement a cookie ...
2
votes
1
answer
382
views
Should I return JWT tokens on a login route even if I am using cookies?
I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to ...
- 21
2
votes
1
answer
13k
views
Where to store JWT refresh tokens
Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
0
votes
1
answer
128
views
Passing user identity to a different REST service
I have two use-cases I am trying to solve.
A HTTP Service-A hosted on XYZ domain tries to access HTTP Service-B on ABC domain. Service-B is a stateless HTTP API which does not have user concept. ...
- 101
1
vote
1
answer
444
views
AES ECB cookie bypass
I am currently participating in a CTF Challenge and have reached a stage where I discovered a "log_admin" page. This page generates a cookie that is encrypted using AES 128 ECB. I obtained ...
- 11
1
vote
0
answers
165
views
SSO Using API based login (not through UI redirection)
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. ...
- 303
1
vote
2
answers
9k
views
Set cookie inside iFrame domain not seen
I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
- 11
0
votes
0
answers
92
views
Options for various auth strategies for express API
OK, I need some help with this:
I am creating a Node express API, and I want to support the following auth strategies:
Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for ...
- 227
0
votes
1
answer
192
views
How does Android/Firefox authenticate the Android Pocket app, for example?
I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. ...
- 649
2
votes
1
answer
508
views
Logout is just clearing cookies [closed]
My friend who is a web developer implemented his session management in a totally new way for me.
He created a random sessionAPPID that is given to the user when he gives correct credentials.
He then ...
- 75
0
votes
0
answers
980
views
best way to keep user logged in with cookie and jwt?
I'm making an SPA with Laravel REST API and trying to keep it stateless.
Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality.
On successful login the client ...
- 11
2
votes
2
answers
793
views
How to implement Double Submit Cookie with Encryption or HMAC
I'm trying to implement the Double Submit Cookie pattern with extra protection using encrypted or signed CSRF tokens. I'm working with a Single Page Application and a stateless API. The purpose of ...
- 121
0
votes
1
answer
323
views
Google Security Cookies; Prevents cookie leak to malicious XHRs
Below is an excerpt from https://policies.google.com/technologies/cookies#security
The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a
browsing session are made by the user, and not ...
0
votes
1
answer
141
views
Why does a page opened via https send an http cookie when I log in? [closed]
I use Brave browser with VPN, I also set it to only allow https. When I log in to my Gmail account, I see http cookies in the security part of the Brave browser. As far as I know, http cookies are not ...
- 3
1
vote
0
answers
813
views
How does a website know if i've visited it before? (and how to bypass that) [closed]
For example: https://pdfcandy.com/pdf-ocr.html has a limit on how many times I can use a feature per hour, but if I use an incognito tab I can easily bypass that.
But with https://ichigoreader.com/...
- 11
0
votes
3
answers
455
views
Do browser vendors have access to LocalStorage/cookies?
Question is pretty much in the title. We have a customer that is very concerned with privacy, and we're making a solution that will rely on data being stored in LocalStorage, so we just need to verify ...
- 103