Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
44 views

What is the math behind SYN cookies?

I understand the reason behind syn cookies is to defend the server against DoS through syn flooding by syn requests from spoofed IP addresses. I also understand that its feature is that it doesn't ...
user avatar
  • 1
0 votes
1 answer
31 views

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
user avatar
0 votes
0 answers
25 views

What are the advantages of a database-based session vs cookie-based? [closed]

I'm in the process of building a session function for my website, and I'm thinking that a cookie-based session will work just fine. for example: cookie = HMAC(user+experation_date+IP_address+...
user avatar
0 votes
0 answers
9 views

Creating half open or full open connection in presence of SYN cookie

Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
user avatar
0 votes
1 answer
43 views

Session cookie security

I am creating a small login system. It looks like the standard username/pwd and user can either log or register. If they pass (authenticate), I create a session cookie that will be sent with the ...
user avatar
  • 15
2 votes
2 answers
60 views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
user avatar
  • 205
0 votes
0 answers
28 views

Cookie-based sessions

During an engagement, i have been asked by a client to explain (with the use of one or more examples) whether having an authenticated cookie-session web upload functionality can be dangerous for the ...
user avatar
0 votes
0 answers
24 views

Passing the session ID of an unauthenticated user to a valid session using Burp

I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension). So ideally, the Autorize says the requests ...
user avatar
0 votes
1 answer
44 views

Session ID not changed after logging in/ logging out

I am testing website security when I came across this: When I enter the site URL, the user is given a session ID without any user input like: 7F746326038B30F51609423B2086BEBB Scenario 1: Once I ...
user avatar
5 votes
0 answers
55 views

Is chrome not blocking all third party cookies?

I opened a website 99acres.com in incognito windows on two browsers on a Macbook. Following are the settings: Chrome Version: 100.0.4896.75 (latest) Third Party cookies: Disabled Firefox Version: ...
user avatar
  • 151
1 vote
0 answers
27 views

Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?

I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity. Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag. The question here is ...
user avatar
1 vote
2 answers
54 views

Cookie-to-header token CSRF protection - is it necessary to verify cookie value?

I'm testing Angular application which uses Cookie-to-header token CSRF protection. According to Angular documentation https://angular.io/guide/http#security-xsrf-protection: When performing HTTP ...
user avatar
  • 1,097
0 votes
1 answer
56 views

Browser sends cookie with "SameSite=Strict" attribute on another domain

I am solving PortSwigger's lab: "CSRF where token is tied to non-session cookie". For testing SameSite attribute I created a cookie in my browser with SameSite=Strict for domain https://<...
user avatar
0 votes
2 answers
64 views

Can someone clone my session Id cookie and login as me?

Because HTTP(s) is stateless, it doesn't remember a username/password combination used to authenticate and assign permissions to a user. I've read that, to overcome this limitation, many websites keep ...
user avatar
  • 137
0 votes
1 answer
48 views

Browser Not Sharing Cookies Between Different Windows

I was quite surprised to find out that both Chrome/Chromium and Firefox share cookies between different windows, even in their privacy-focused modes. This seems a huge threat since it gives an ...
user avatar
0 votes
0 answers
48 views

What's the best way to handle authentication across multiple different domains under the same service?

For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains? For the main site, example.com, I am currently using: &...
user avatar
  • 1
0 votes
1 answer
87 views

Url only works from the browser it is generated from. Copying it into a Curl Command fails, and gives a 403 error. How can I fix this?

I am doing some web scraping for streaming files, .m3u8 mime type. In this particular instance, I can't create a functional request that does not end up with a 403 Forbidden error. How to reproduce: ...
user avatar
0 votes
1 answer
98 views

JSON Web Token splitting

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
user avatar
1 vote
0 answers
17 views

Cookie hijacking query [duplicate]

I am trying to understand cookies and the hijacking/mitigation methods. I have noticed that some websites are more secure than others. For example, I have two browsers (Edge and Firefox). I have ...
user avatar
  • 111
1 vote
3 answers
126 views

What's the point of blocking third party cookies in incognito?

When using incognito, any data will be cleared when the session is closed. Then why do browsers have the option to disable them?
user avatar
0 votes
0 answers
36 views

What mechanisms can make a site start gathering cookies for 3rd parties?

Imagine starting with a basic site which has no links and no code which stores tracking cookies. Assume the site should remain that way as it grows in features and content. What are the mechanisms ...
user avatar
0 votes
1 answer
134 views

TikTok tracking - no account

I downloaded TikTok once - about 2 years ago. I never created an account, and I deleted it about a week later. About a month ago my youtube feed started getting TikTok reccomendations. I'm curious as ...
user avatar
0 votes
0 answers
39 views

Should user session be restricted to a given IP? [duplicate]

If users are authentified with a sessionID (through cookies), would it increase security if we force users to log in again if for any reason their IP changed during their session? Or is this not worth ...
user avatar
  • 101
1 vote
1 answer
160 views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
user avatar
  • 113
0 votes
0 answers
70 views

cookie forging: How to replace session cookies

I am working on a pen-testing challenge, where I want to see if the session cookie can be forged by leveraging the vulnerable flask application (i can't disclose the url due to agreement). I have been ...
user avatar
  • 101
0 votes
1 answer
111 views

What is considered a secure way to store JWT in browser?

I'd like to rewrite a monolithic social website to use JWT for authentication instead of traditional cookie/sessionm, and I'm looking for a secure implementation. I read here that: You might think an ...
user avatar
  • 1
0 votes
1 answer
126 views

Why can't you give special security cookies to a specific crawler so that they could securely crawl the website?

In the current day and age we have the problem of malicious/spam crawlers and similar concerns. My suggestion would be implementing cookie support for crawling and by that I mean giving specific ...
user avatar
  • 190
0 votes
1 answer
155 views

Cookies Vs Headers For REST API User Authentication Token

I'm working on a small rest api project with user authentication. But I'm wondering whether I should store the users authentication token in a header or a cookie. The general idea is as follows: User ...
user avatar
  • 3
0 votes
0 answers
65 views

Ways of Authentication in case server and client are hosted on different domains

I´m working on a project where user authentication is required. For some reasons we have to host the frontend and the backend on different domains. I usually send httponly cookies from server to ...
user avatar
  • 101
13 votes
1 answer
384 views

How do big websites (e.g. Google, Twitter, GitHub, ...) have practically infinite session lengths without compromising on security?

I'm currently implementing a login session system for a web application. I've read lots of articles recommending very low session and idle timeouts. For example OWASP says: Both the idle and absolute ...
user avatar
1 vote
1 answer
167 views

What's arstechnica.com messing with my Firefox cookies?

I decided to post on Security as it's more a privacy-oriented question. I could post it on Superuser as a browser question. These days I am experiencing a strange behaviour with Firefox 92.0.1 ...
user avatar
0 votes
1 answer
76 views

Is this insecure to show in cookie Google Tag?

While researching one site, I found that if you enter document.cookie (Firefox) I can see this filed in cookie _gat_gtag_UA_XXXXXXXXX_1=1. There were plain text. As I know gtag is for Google Tag ...
user avatar
  • 137
2 votes
2 answers
2k views

Is it possible to set an HttpOnly Cookie from one domain to another subdomain

I am pretty sure that the answer to my question is no, but I have been have a hard time finding an answer through official documentation or other posts here. Here is simple use case for some context: ...
user avatar
0 votes
1 answer
131 views

How secure does a session cookie have to be?

For personal learning I'm developing a webapp (PHP+MySQL) with login procedure as described in this article. I'm using two (pseudo)tables for validation: [users] id | username | password_hashed [...
user avatar
0 votes
2 answers
142 views

can HSTS be considered as a remediation for not using secure flag for a pci dss auditor [duplicate]

can HSTS be considered asa remediation for the vulneraberabity "cookies are not protected by secure flag" for a PCI DSS auditor?
user avatar
1 vote
1 answer
149 views

Is it possible to use cookie-based single sign-on authentication scheme if sites do not share a common DNS parent domain?

According to the "Single sign-on" page on Wikipedia: A simple version of single sign-on can be achieved over IP networks using cookies but only if the sites share a common DNS parent domain....
user avatar
  • 351
1 vote
0 answers
191 views

Does Safari's "Prevent cross-site tracking" option ACTUALLY prevent determined efforts at cross-site tracking? (By, e.g. Facebook)

In other words: Does Safari's "Prevent cross-site tracking" option effectively prevent cross-site tracking? (Is it for purpose?) I though it would work; are my expectations off? Or, more ...
user avatar
0 votes
1 answer
185 views

Should analytics cookies be HttpOnly?

Should ga gid gat and Fbp cookies be flagged as Secure and HttpOnly? Is there a way an attacker can use them if accessed?
user avatar
  • 89
0 votes
2 answers
430 views

Cookie-to-header token CSRF protection

I have the Angular application where CSRF protection is implemented using Cookie-to-header token. It is default AngularJS mechanism to counter CSRF, which uses cookie XSRF-TOKEN and header X-XSRF-...
user avatar
  • 1,097
1 vote
2 answers
106 views

Protecting against cookie/session re-use with a sequence generator

I might be completely making this up as a solution or even feasible. I have a situation where a cookie exists for a browser/user/tab. In the background, while the user is viewing a page a request is ...
user avatar
0 votes
0 answers
108 views

I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?

We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
user avatar
0 votes
0 answers
296 views

Stored XSS cookie stealing, but a loop of redirection

I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack. So on my remote server I run an HTTP server with Flask using python where there is ...
user avatar
0 votes
0 answers
123 views

Blind MSSQL Injection - Stacked query in cookies

I am currently working on a bug bounty program and in one subdomain of my target there is a Blind SQL flaw in a cookie. The back-end is MSSQL/ASP.net however, since cookies are separated by semicolons ...
user avatar
0 votes
0 answers
101 views

Can browser extention be compromised via cookie hijack?

Recently my PC has succumbed to an attack of this form caused by trojan and most propably all my cookies from Firefox were stolen. I concluded that after finding out that someone logged on to my ...
user avatar
  • 1
1 vote
0 answers
259 views

Is a static SameSite cookie enough to protect against CSRF?

Conventional wisdom to prevent CSRF is to use CSRF tokens, but with the new cookie attributes and prefixes, do you even need to generate/save tokens at all? I've had the thought that if I just set a ...
user avatar
  • 113
2 votes
1 answer
286 views

Why does Chrome require Secure for SameSite=None cookies?

As I understand it, the SameSite attribute for cookies helps me advise standard browsers what they can do with them. So if I'm a server running on http://acme.com/my-app and I've set a cookie like: ...
user avatar
  • 143
1 vote
2 answers
476 views

What if a browser does not honor the "expires" directive of a cookie

I am currently using the Python Flask framework's default session function to manage user login. My understanding is that, session function essentially is an encrypted cookie stored in a client's ...
user avatar
1 vote
1 answer
141 views

Is it a security concern to have a user id in a cookie?

I want to track a user who has previously logged in so that I can associate traffic behavior with their user record on our system. Does storing the user's id as a single value in a cookie cause ...
user avatar
2 votes
1 answer
152 views

"Trusting" the Host header in a port-forwarding environment

A similar question has be answered here already, but I have a very specific scenario in which it didn't fulfil my requirements. I am setting up an environment which includes a web-service running on ...
user avatar
  • 306
2 votes
1 answer
170 views

Would "same-origin cookies" make sense?

I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on. ...
user avatar

1
2 3 4 5
16