Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
0
votes
1answer
40 views

How secure is to authorize a website to “trust your device”?

A bank has a form of 2FA where, after you put in your username and password, they send a code via SMS to your mobile phone and you have to put that too. On the screen asking for the SMS code, there ...
2
votes
2answers
389 views

Exposed my browser cookie of my request header

I exposed my browser cookie of my request header in a web forum. After I realized what I have done - I logged out, cleared my browser and logged in again. Am I safe now? Can someone still use that ...
0
votes
1answer
27 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
1
vote
2answers
47 views

Cookie-to-Header CSRF protection vs CORS

What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario? Example scenario: A rest API called api.com provides data to good.com. api.com has allowlisted ...
0
votes
0answers
39 views

Path of Set-Cookie HTTP Response Header

The Tangled Web notes: URL paths are not taken into account during same origin policy checks and, therefore, do not form a useful security boundary Given that, is there any reason to set the Path or ...
1
vote
1answer
62 views

Is Google cookie a first-party cookie?

Recently, after blocking third-party cookies, I thought that all non-domain cookies will be blocked. But as a surprise Google (google.com) cookies are not removed even if there is no link between the ...
1
vote
0answers
47 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
0
votes
0answers
57 views

Why does using JWT refresh tokens protect against CSRF during authentication?

I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance ...
1
vote
1answer
105 views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...
1
vote
1answer
60 views

Mitigating physical cookie theft

Threat model: Malicious user gaining physical access to browser cookies (e.g., 3rd party repair guy copying cookies to his own device or something like that). Let's say legit user did not clear ...
0
votes
0answers
41 views

Security idea for storing JWT tokens, is this a good idea?

I have been reading a lot about where you should store your JWT tokens for web applications. Local storage and cookies has its pros and cons. So I thought that maybe it could be a good idea to instead ...
0
votes
0answers
47 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
1
vote
0answers
44 views

Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]

Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
1
vote
2answers
127 views

Does a professional website know that person A switches the Chrome “user” and logged into its website with another email address?

Let's say I have account A on site example.com that has a policy of strictly one account per real person. I then create a new Gmail address, use that Gmail address to open a new Chrome user (not ...
0
votes
0answers
80 views

CTF XSS Session Hijacking

I'm playing a complete noob in terms of security but a friend invited me to play a internal CTF for my company and I'm stuck with this challenge. I have a simple website that goes as follows: http://...
1
vote
1answer
61 views

Based on cookies, does a website knows that a user visited it if the user does not log in?

I, user ABC, have an account on some financial website example.com. I have logged in from my browser many times before so cookies were saved. Each time I would log off after I finish browsing that ...
0
votes
0answers
22 views

Authentication Cookie Security Features

I am completely stuck and I need to make sure that I am correct. Any help is greatly appreciated. Based on the cookie, I need to answer these questions: Select which security features does the cookie ...
0
votes
1answer
30 views

Account switcher in browser implementation and secure design

I am trying to understand how websites implement in-browser account switcher. e.g you can login to twitter using multiple accounts. On the bottom left when you click your currently logged in account, ...
1
vote
1answer
51 views

What you can do with super cookies on subdomain to harm domain?

When you search in Google for user cookies top results are VPN services that say that it's used by ISP to track the users. Wikipedia Supercookie say nothing about HTTP headers and what exactly are ...
1
vote
1answer
56 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
8
votes
2answers
206 views

Why does Spring Security unset and set the same Cookie in one Request?

In the CSRF implementation of Spring Security (https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java#...
1
vote
1answer
86 views

Does incognito mode prevent cookie-theft attacks?

A fresh incognito browser will not have access to any cookies An active session however, will surely save cookies somewhere so I don't have to login to gmail every time I access gmail.com in the same ...
0
votes
1answer
42 views

Is there a way to modify the value of a session token with HttpOnly flag set in this scenario?

SCENARIO: When a user browses to the login page the web application sets SESSIONID=X; Httponly; before the authentication. After the authentication NO new cookies are set. The only cookie used to ...
1
vote
0answers
100 views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
0
votes
2answers
58 views

Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain

I have three domains but the same code base (Domain X, Domain Y, Domain Z) and Accounts website A If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
0
votes
0answers
79 views

Execute sqlmap in a javaScript object cookie

I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap. Cookie looks like javascript object ...
0
votes
1answer
82 views

How to securely transfer cookies between two domains?

Let's say you have a website https://example.org which is being decommissioned and redirected to https://example.net. Your users have a cookie on https://example.org which contains some authentication ...
0
votes
0answers
40 views

Should you even bother trying to hide authentication from XSS?

I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much ...
3
votes
1answer
89 views

Does a website's session key have to be unguessable if it's signed?

I'm creating (what I believe to be) a cryptographically hard to guess session key to keep my users logged in by generating 32 random bytes (using crypto.randomBytes). I'm storing this in a cookie (as ...
3
votes
0answers
80 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
23 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
2answers
69 views

Is it safer to send cookies in headers than the URL?

I have a browser extension. I would like to use this browser extension to send the cookie from site A to site B. I’m doing this because I want to scrape site A from site B, but this is obviously a use ...
0
votes
2answers
67 views

Can we read HTTP cookie value? [closed]

In one of the applications I'm testing, the cookie contains the username (set:cookie: username) in the HTTP header. Is it possible to read these cookie values using any methods? The site uses HTTPS.
2
votes
1answer
59 views

Should the Secure cookie flag also be set on HTTPS only websites?

Should the cookie secure flag be set on websites which are served only through HTTPS? The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel ...
0
votes
1answer
251 views

iframe-friendly CSRF protection

In general, CSRF protection means this: "compare <input type=hidden> with a value in user's session" (or sometimes - user cookie). Now, suppose I want my app/website to be iframe ...
0
votes
0answers
63 views

Caching session id. Should be this reported?

BACKGROUND: I'm reading the OWASP testing guide for web applications Session ID should never be sent over unencrypted transport and should never be cached. ... Furthermore, whenever the Session ID ...
3
votes
2answers
215 views

Can a web page really log keystrokes on a different page shown later on the same tab (or a different tab)?

According to this Reddit comment, an advertisement on one page seems to be able to log a user's keystrokes on a different page (if I understand the comment correctly). Is this really true? Can an ...
1
vote
0answers
84 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
0
votes
2answers
57 views

Store cookies for multiple sites on remote server and connect from multiple clients

Would it be secure to: Store all my website cookies (stack sites, webhost, github, web-based email, etc) on a remote server (using an customized open-source VPN or something) Login to the server with ...
0
votes
1answer
82 views

Is it poor practice to host multiple web applications on the same domain, in terms of cookies?

In my web application, I have a single API backend and two frontends written as single page applications. To simplify deployment, I'd like to serve the API on /api, the admin dashboard on /admin, and ...
35
votes
3answers
5k views

Can ISPs replace a website's HTML/JavaScript/HTTP headers with something else?

It seems to me that "yes, they can". As I saw it in some countries, entering adult content will simply give a warning message that the site is blocked. Some places even block Facebook ...
0
votes
0answers
109 views

CSRF token not sent when calling the back-end?

My system composes of NuxtJs and AdonisJs application. Adonis handles csrf tokens for us by sending: set-cookie: adonis-session=XXX; Path=/; HttpOnly set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; ...
0
votes
0answers
45 views

What if session cookie is stolen? Doesn't it have a similar effect with getting access token stolen

Most security specialist teams, OWASP, Auth0, Okta to name some, agree on that keeping access token in browser should be avoided. And one of the alternatives to this approach is having a proxy server ...
1
vote
1answer
176 views

Is it necessary to encrypt a JSON Web Token more than what is built-in?

As a developer I do have some understanding of OWASP, I am also a member of OWASP community, official due paying one. Anyway, what I may not understand is information security in that I am not a ...
1
vote
0answers
60 views

Allowing 3rd-party cookies in major 2020 browsers [closed]

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
0
votes
0answers
103 views

Simplest secure way to create session cookies

Background: I've been using a simple session cookie design for my web app. I have a users table, and a sessions table that basically looks like this: id | user_id | visited_at -----+---------+-------...
-1
votes
2answers
152 views

Can a website track your browsing history on other websites?

I visited website B after visiting website A. Upon clicking the search bar on website B, a dropdown menu appeared containing the words I searched on website A. After clearing my browser history and ...
0
votes
1answer
179 views

Third party cookies - does secure, httponly matter?

Was viewing this page on cookies and wondering for those under Third party cookies, such as TS*, TS01*, TSXXXXXXX_d, what does it mean by them being a "security" cookie? Does it mean there ...
0
votes
0answers
34 views

CSRF in an API that's used by both browser and apps?

I've recently learned about CSRF, I know that CSRF is for browsers, not apps, which makes sense. but I have a few questions. if an API is used by both browser (front-end) and apps (iOS/android), what ...
2
votes
1answer
95 views

How secure is (permanent) cookie-only authentication?

I'm making an webapp which have to maintain some user specific data, so authentication is needed. My app is not anything mission critical. As this is the case, I thought of removing the whole sign-up/...

1
2 3 4 5
15