A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

learn more… | top users | synonyms

3
votes
1answer
35 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
3
votes
1answer
58 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
1
vote
1answer
44 views

is browser the only app that can set supercookies?

I'm trying to identify a if a website uses tracking cookies beyond ordinary cookies, that get deleted when I click "Delete cookies". The work plan is to run a clean virtual machine, use a software ...
19
votes
5answers
4k views

How to tell if a webapp transmits my password in cleartext?

I am trying to see if a webapp transmit password in some form of cleartext. The problem is that the web app is NOT using https! This is why I wondering is my passwords is sent in clear text. I've ...
3
votes
1answer
95 views

Is setting logon cookies in JavaScript insecure?

I'm facing a limitation in a backend system that can only set a single cookie via the Set-Cookie header which the front end uses to make an AJAX call to log the user in. The authentication system ...
2
votes
1answer
59 views

How to detect, inspect and delete a super cookie of a specific website? [closed]

Definition of supercookie from the paper I am reading: "Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local ...
0
votes
0answers
14 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
2
votes
1answer
63 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
3
votes
2answers
61 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
1
vote
1answer
53 views

Why do some websites tell you they use cookies? [closed]

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't? For example:
0
votes
2answers
88 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
0
votes
0answers
52 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
2
votes
0answers
68 views

If I clear my browsing data, is HSTS protection removed?

I've seen that if I delete cookies and other data on Google Chrome, SSLStrip+ works successfully on those web sites that are not included in the browser list. Is it because HSTS data is cleared too?
0
votes
0answers
39 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
1
vote
0answers
47 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I ...
4
votes
2answers
52 views

Securely Erasing Cookies

Is there any sort of officially defined procedure (Eg from IETF) on how to correctly unset a cookie? I've always considered it best practice to unset any session cookies at logout for a web ...
4
votes
2answers
211 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
1
vote
1answer
26 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
4
votes
2answers
123 views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...
1
vote
1answer
74 views

FireFox inadvertedly increasing security?

With the known advent of Flash-based cookies and recently something called super-cookies, security and anonymity has become something more of a luxury rather than the norm and merchants want to ...
1
vote
2answers
100 views

Prevent Session Hijacking, where an attacker steals Session ID(cookie) from the browser physically

Consider a case, where an attacker has physical access of user's machine for 20-30 seconds. The attacker can use this time to steal user's cookie (say using EditThisCookie plugin) and send the cookies ...
0
votes
3answers
122 views

Does allowing Facebook cookies over TOR threaten my anonymity?

I was using Facebook on TOR without problem - I made no modifications to TOR, I just installed it and used it (except I had to do verification of identifying friends on login). I just switched to ...
1
vote
3answers
144 views

Authenticating user in same sub-domain using cookies

We have few in production websites say site1.dom1.com , site2.dom1.com , site3.dom1.com which are just replicas working on different server. Now we want to extend some application on another server ...
1
vote
2answers
105 views

When should server side sessions be used instead of client side sessions?

From an information security perspective, when should server side sessions be enabled instead of client side sessions? From what I gather, "secure client side sessions" are cookies that contain data ...
1
vote
0answers
49 views

Open source tool to test a WAF against OWASP Top 10? [closed]

Are there any open source tools to test a WAF against OWASP Top 10? Especially I am looking for a tool that tests a WAF against different types of attacks & reports test results.
0
votes
1answer
123 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ...
3
votes
2answers
78 views

In what case should one encrypt cookies?

I am curious how one decides whether to encrypt cookies or not? And if so when should one use public private key over symmetric encryption?
0
votes
1answer
343 views

Accesssing cookies of another domain using Iframes and Javascript

Using Iframe we can embed webpages of another domain provided the X-Frame-Options isn't set to SAMEORIGIN. This also loads the cookie inside the iframe. Now, one can access this cookie if it's in the ...
0
votes
1answer
48 views

Allow visiting website B only if you visited website A first [closed]

Having two websites: A and B. I want that the users that open website B to get redirected to another website (e.g. http://example.com) if they didn't visit the website A. To do this I tried to set a ...
3
votes
3answers
164 views

What CSRF attacks will 'First-Party-Only' cookies protect against?

The new 'First-Party-Only' cookie attribute: ... allows servers to assert that a cookie ought to be sent only in a "first-party" context. This assertion allows user agents to mitigate ...
2
votes
2answers
117 views

Is encrypted cookie without authentication secure enough?

I have some sensitive data in the cookie, e.g. it contains the user id that is later on used to execute the query and we trust the cookie because it is encrypted. All communication happens only on ...
3
votes
1answer
73 views

Is same origin policy for web only useful because of cookies?

There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are ...
20
votes
2answers
2k views

Stealing Facebook HTTPS cookies with captive portal

I have a security concern. As we know, many public hotspots redirect you to a login screen when you try to surf the first web site. For example, if I connect to such a hotspot and then visit ...
6
votes
1answer
116 views

Third-Party-Cookies Tracking - Google Chrome

I've read an article about third-party-cookies which explained that in Google Chrome disabling third-party-cookies will not stop the browser from sending third-party-cookies. So when I visit Facebook ...
2
votes
1answer
54 views

Is a 'remote' cookie replay attack possible?

Once a cookie is stolen from the session of a legitimate user, can I perform a 'remote' cookie replay attack on that user? I am successfully able to perform a cookie replay attack on the same system, ...
-3
votes
3answers
68 views

How important are my cookies from a security perspective?

If a hacker makes a copy of all my browsing cookies, what could he/she do with that? What are the worst case scenarios?
0
votes
1answer
29 views

Javascript Valuable Webpage Data

When malicious users and attackers seek to steal data using XSS, they can send attributes like document.cookie to a malicious server, correct? Does this attribute have all of a users cookies for a ...
7
votes
3answers
829 views

Why can't cookie hijacking be prevented by associating cookies with IPs? [duplicate]

I just started reading about cookies and all the ways I can get them wrong and allow cookies to be hijacked which allows attackers to do things like impersonate a logged in user. I don't understand ...
0
votes
2answers
480 views

How to create a secure login system with cookies? [closed]

For my personal education, I am trying to create a secure login system using cookies. I have read a lot of articles and Stack Overflow questions on how to achieve that, but couldn't find anything ...
0
votes
0answers
15 views

Cookies carrying Session identifiers

Is there a list of names for cookies carrying SID's? For instance: PHP by default uses PHPSESSIONID Tomcat uses JSESSIONID ... I would like to be able to intercepts all SID's supplied via ...
1
vote
4answers
87 views

What are cookies and cache?

While surfing on the Internet, I am often afraid that I may have downloaded some malware program along with some files on my computer. Furthermore, I have been told that the reason for that are ...
2
votes
1answer
67 views

What are the risks of allowing the storage of persistent cookies on your system?

Usually, the risks of persistent cookies are described from the point-of-view of the site, not the user: if you implement persistent cookies the probability of someone stealing a cookie and using it ...
2
votes
2answers
141 views

I delete cookies file in chrome but i'm still logged in after I restart Chrome

I'm using linux and google chrome as browser. I know that cookeis are stored at /home/my_name/.config/google-chrome/Default/Cookies. I deleted this file but it seems like when I restart Chrome and ...
0
votes
4answers
131 views

Is session expiration for all web applications possible?

In case someone visits an infected site his safety, if his cookies get stolen, may be compromised. Is there any abstract way to expire a session on the stolen session-id so that the id is practically ...
1
vote
1answer
284 views

Session Expiry due to weblogic.xml for mitigation of cookie hijacking? [closed]

To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did: Example that we had applied on weblogic.xml and faced ...
2
votes
1answer
121 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - Passport is just a library that is popular for Node.js server authentication - but we have some questions about how to use Passport with ...
4
votes
2answers
128 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
3
votes
1answer
261 views

Would this work to protect a cookie with an OAuth token?

I'm currently trying to set up an OAuth 2.0 authentication scheme to protect some stateless REST webservices. These services deal with sensitive information, and the OAuth support is a requirement. ...
2
votes
0answers
44 views

Is there any risk if my Google Analytics cookies can be seen by an attacker?

In particular, I'm concerned about a scenario where I'm using GA cookies on a subdomain, e.g. alice.example.com, and the cookies are marked as .example.com, which means that a site on eve.example.com ...
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...