Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

1
vote
2answers
55 views

Is it imporant that a cookie should have secure flag set if the website is running on HTTP?

I am working on a website and I want to know if a cookie needs to have a secure flag set or not if the website is running on HTTP. Also, httponly flag is set on cookie but there is no secure flag.
0
votes
0answers
44 views

Who / what has access to delete cookies?

I'm experiencing an odd issue lately where I'm frequently being logged out of YouTube, but not from other Google services. Upon further investigation, it looks like the SID cookie which is used to ...
0
votes
0answers
26 views

Perform an authorized action via Postman [closed]

There's an old php website that I want to automate some tasks. Think of it as Craigslist in another country but much less sophisticated. In this website, I can send messages to users only when I am ...
0
votes
1answer
66 views

How to do authentication when FE and BE are on different domains?

We're doing authentication by sending a JWT via an httpOnly cookie. (client sends credentials, server answers with a token cookie, client attaches it to all subsequent requests). Due to some ...
0
votes
1answer
97 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
0
votes
0answers
36 views

How does the Brave browser protect against sites that a person has already logged into?

I understand that the Brave browser does not allow for 3rd party cookies to be set so that a user will not be tracked by a 3rd party site. However if I were to log into a site like Facebook and ...
3
votes
2answers
225 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
0
votes
2answers
53 views

Cookie generation

What is the most secure was to generate cookies that makes it hard for a user to be able to guess the session cookie of another particular user or that will be accepted as a valid session cookie. ...
1
vote
1answer
100 views

Can an XSS exploit on a subdomain steal the cookies of the parent domain?

As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its ...
0
votes
1answer
48 views

Would cookie always change when browser changes?

I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it'...
1
vote
0answers
80 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
2answers
56 views

3rd Party trackers and online privacy

I don't feel the internet is respecting our individual right to privacy. Why are 3rd party trackers allowed to siphon data from us without our permission? We should selectively be able to reveal what ...
2
votes
1answer
44 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
0
votes
1answer
29 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
0
votes
2answers
142 views

Why not write the CSRF Token into the Session

I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
4
votes
1answer
152 views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
0
votes
1answer
82 views

Browser session cookies stolen/copied to another PC, why websites not smart enough prevent it?

Just out of curiosity and security test, i copied my own browser's cookies to another pc on same browser and surprisingly i managed to open facebook and google accounts with existing sessions even ...
2
votes
0answers
66 views

Storing credentials in cookies? [closed]

Is there any use case where you would store hashed credentials in a cookie? EDIT I was discussing this problem with a colleague if it's advisable to do this. Since then, I found an example where a ...
3
votes
2answers
233 views

Why not store password in cookie?

I've got a novice question - It is often said that you should not store plaintext passwords in a client-side cookie. (I'm imagining a web browser cookie, but I supposed this applies in general.) But ...
1
vote
1answer
98 views

How can CSRF POST happen?

I realise this is a newbie question but when it comes to this im clearly that. On a browser, assuming one received a cookie from site A. Then a different site B makes a call to site A through it's ...
0
votes
1answer
237 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
1
vote
0answers
218 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
0
votes
1answer
53 views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
0
votes
2answers
102 views

modifying an httponly cookie before sending the request

can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie. If yes, then how? I know modern browsers don't allow this. But if you could,...
0
votes
2answers
119 views

Authenticated Sessions on a Desktop Application

I want to implement a login into my C++ desktop application and I'm having a hard time finding information on managing login sessions without cookies or JWT (JSON Web Token) (more on that in a bit). I ...
0
votes
1answer
136 views

Not destroying cookies at log out

As a beginner pentester, I was pentesting one of our applications and found that the cookies are not getting destroyed when a user log outs. The cookies did come with an expiration time and date. ...
1
vote
0answers
16 views

Is HSTS necessary or can I just write .htaccess code to always redirect http to https? [duplicate]

Is HTTP Strict Transport Security (HSTS) necessary or can I just write regular .htaccess code to always redirect http to https?
1
vote
0answers
203 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
1
vote
1answer
43 views

Site inaccessible with Cookies turned off in browser [closed]

Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
1
vote
2answers
80 views

How to implement secure user sessions using HttpOnly cookies?

I'm creating a web application, and want to allow users to log in (and stay logged in). My plan to support this in a secure way goes as follows: User logs in from a login form - when successful, the ...
2
votes
0answers
64 views

Alternative to sensitive data in cookie

My company has a travel app which helps you buy tickets for work related travels. When you need to travel you enter your details on SAP and it it sent to your manager for approval. When it is approved,...
-4
votes
1answer
66 views

Can cookies help hacker to access our activites?

I have read about cookies of browsers. I read that cookies can store our browser's history. Whatever we have searched and whatever we have watched all kind of activities storied in cookies. I also ...
0
votes
1answer
125 views

If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies?

Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? I was asked to ask this as a separate question. This isn't a duplicate question. Okay, so ...
2
votes
1answer
487 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
0
votes
1answer
496 views

How to get the cookie of embedded iframe

I'm embedding an iframe on my site < iframe id="demo" src="https://example.com" > example.com has a cookie (not a http-only cookie) How can I get the cookie?
0
votes
1answer
46 views

Whether cross cookie sharing between the android apps is potential threat to privacy?

Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
1
vote
2answers
53 views

Effects of new random Session token for each HTTP Request

On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters. ...
0
votes
1answer
67 views

Secure and HttpOnly flag for load balancer cookie

Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a ...
84
votes
5answers
20k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
9
votes
3answers
430 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
0
votes
2answers
1k views

JWT or session cookie for API for both web and mobile app?

I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach. The only two requirement are: I need to know the users that are ...
3
votes
0answers
434 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now ...
8
votes
1answer
274 views

What is a “Cookie Swap” password reset attack?

Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here. While I do not like to make these type of posts I ...
3
votes
1answer
487 views

How does Google save authentication information in the browser? [duplicate]

When I open Gmail in the browser, I automatically log in. I believe this is because of the previously saved cookies. If I remove cookies I need to sign in again. It means Google saves some auth keys ...
1
vote
1answer
75 views

How to prevent expired cookies from maintaining accesss?

My company has a website that was recently the target of a security audit. They found that if a hacker had obtained the browser cookies used by our .NET website for authorization, that those cookies ...
1
vote
2answers
121 views

How do I know exactly what type of information Github collects from a visitor?

I keep track of the upload bandwidth on every site that I visit, and I've noticed that the most site that uses upload bandwidth is Github.com every single page that I visit uploads 1.06MB of data. ...
0
votes
2answers
195 views

Do websites outside of the EU need to consider GDPR? [closed]

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...
1
vote
2answers
598 views

Storing OAuth access and refresh tokens in non HttpOnly cookies

I am using OAuth auth code flow to generate access and refresh tokens and then I store them in two browser cookies that are not HttpOnly and send them back too the client. The cookies need to be non ...
0
votes
1answer
119 views

Suspicious Redirect to malicious website

While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared. I clicked on a button in order to locally download an excel sheet (report) that was ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...