Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
1
vote
1answer
95 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
0
votes
1answer
58 views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
0
votes
0answers
39 views

Is it possible to replace a cookie value through csrf? [on hold]

I found a request that looks vulnerable to csrf but that same request need a valid cookie to work. If you sent the request with a wrong jsessionId cookie value you get a 400 bad request while if you ...
1
vote
1answer
61 views

What can happen if my Flask SECRET_KEY becomes public?

I use OpenID Connect to let my users login. What could happen if Flasks SECRET_KEY becomes public?
1
vote
1answer
95 views

XSS in iframe can't access document cookies

I know of a website, lets call it website.com, that has these vulnerabilities: iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
1
vote
1answer
45 views

Reverse proxy isolation from insecure blog, are sessions vulnerable?

Hi I have a WebApp where security is important. E.g. www.somewebapp.com The app has a wordpress blog (hence not secure since wordpress). e.g. www.somewebapp.com/blog To protect the webapp from ...
1
vote
1answer
66 views

How to prevent security risk when logout failed for authentication cookies

In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected. But it seems that ...
0
votes
1answer
76 views

Cookie-Based Authentication Security of Popular Websites [closed]

Let's take Google and other popular bank websites which uses cookie. I've been working with a website using Angular which uses Laravel as an API. Data are stored in cookies which is vulnerable in ...
0
votes
2answers
71 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
1
vote
0answers
49 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
2
votes
1answer
94 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
0
votes
0answers
57 views

Is it secure to prevent CSRF in API without using CSRF cookie (only CSRF token sent in header of ajax requests)?

There is a standard method of preventing a CSRF attack by comparing a value in a special cookie (that is posted automatically with each request) and some value that is coming either in form post (from ...
1
vote
1answer
101 views

Why sign session cookies? [duplicate]

I'm using express-session middleware to store sessions on the server. The client's browser gets a cookie with the session ID. A secret is required in the configuration; it is used to sign the session ...
0
votes
1answer
32 views

Is it possible to infer advanced cookie properties like expiration from Wireshark

I want to perform a cookie injection attack for demonstration purposes. I could achieve this using Firefox Cookie-Editor extension. However, the attack can only succeed if I enter the cookie name, ...
0
votes
1answer
96 views

How to stop other programs from reading passwords stored in my browser?

I was very surprised and alarmed to see that a free software could list passwords stored by browser in plain text. I thought that these passwords (such as the ones for email) are encrypted and can't ...
0
votes
2answers
62 views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
0
votes
0answers
75 views

Does copying cookies from one pc to other makes Gmail believe that the other device is not a new device login?

Each time I login into a new device either Gmail or Facebook login, it send a notification to my mobile saying a login is detected in a new device stating the device name or OS name. I am curious to ...
0
votes
1answer
41 views

Cancelling a request stops new authentication cookie getting to browser, invalidating all further requests

I am trying to secure my login system using authentication cookies. If the user tries to access a protected resource they must provide an authentication cookie. If the cookie is valid, the request is ...
1
vote
1answer
77 views

How does SameSite cookie header prevent tracking?

I understand how SameSite cookie header prevents CSRF. But how does it prevent tracking by 3rd party sites, since they could set SameSite=Lax or None, and the browser will still send them: https://web....
0
votes
1answer
112 views

Are subdomains secure from one another if they are on separate servers?

I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com). Each user application will be run on separate servers ...
2
votes
1answer
77 views

When using a shared / public VPN, can others on the same IP address log into your accounts?

I know browsers use cookies so that, for example, if I log into Facebook on a public computer and forget to log out, the next person who opens up a new browser can go into my account. Does this work ...
0
votes
2answers
142 views

Delete secure cookie using javascript

After reading some responses here and in other sites, I am a bit confused if a secure cookie (not httponly) can be deleted in client side using js. for example, @8zero2-ops says that there is no ...
0
votes
0answers
56 views

Why is it wise, from a security POV to have sessions expire? [duplicate]

It is a common practice to have sessions expire for users when they are logged in for a long period, especially if they are inactive. I've seen this particularly employed in systems where sensitive ...
60
votes
5answers
8k views

What are the risks of just clearing cookies instead of logging off?

A typical web authentication workflow looks like this: User provides their credentials. Server validates credentials. If credentials are valid Server generates a token. Server keeps this token. ...
-1
votes
2answers
94 views

CDN change for “enhanced security”? (now uses cookies)

For the past few months, I've been unable to continue a particular course on udemy. I can access all other video courses accept that particular course and their support has answered "We recently ...
2
votes
3answers
394 views

Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?

ASP.NET documentation says: FormsAuthentication.SignOut() Removes the forms-authentication ticket from the browser Why is the cookie not invalidated at the server as well? It would be easy ...
1
vote
2answers
126 views

What is advantage of passing request / response data via cookies instead of regular query parameters?

I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (...
1
vote
3answers
338 views

is having a `set-cookie: sessionid=xxxxxxx` in every response considered bad practice?

My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ...
-1
votes
2answers
281 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
0
votes
1answer
215 views

How can I inject cookie from Wireshark into a browser sesson [duplicate]

For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password). I collected traffic during a login ...
4
votes
1answer
67 views

Plausible scenario for a PHP session fixation attack with default settings?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings. Given session....
0
votes
1answer
217 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
1
vote
2answers
87 views

Is it imporant that a cookie should have secure flag set if the website is running on HTTP?

I am working on a website and I want to know if a cookie needs to have a secure flag set or not if the website is running on HTTP. Also, httponly flag is set on cookie but there is no secure flag.
0
votes
0answers
61 views

Who / what has access to delete cookies?

I'm experiencing an odd issue lately where I'm frequently being logged out of YouTube, but not from other Google services. Upon further investigation, it looks like the SID cookie which is used to ...
0
votes
1answer
119 views

How to do authentication when FE and BE are on different domains?

We're doing authentication by sending a JWT via an httpOnly cookie. (client sends credentials, server answers with a token cookie, client attaches it to all subsequent requests). Due to some ...
1
vote
1answer
249 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
0
votes
0answers
62 views

How does the Brave browser protect against sites that a person has already logged into?

I understand that the Brave browser does not allow for 3rd party cookies to be set so that a user will not be tracked by a 3rd party site. However if I were to log into a site like Facebook and ...
3
votes
2answers
483 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
0
votes
2answers
107 views

Cookie generation

What is the most secure was to generate cookies that makes it hard for a user to be able to guess the session cookie of another particular user or that will be accepted as a valid session cookie. ...
1
vote
1answer
245 views

Can an XSS exploit on a subdomain steal the cookies of the parent domain?

As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its ...
0
votes
1answer
58 views

Would cookie always change when browser changes?

I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it'...
1
vote
0answers
250 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
2answers
59 views

3rd Party trackers and online privacy

I don't feel the internet is respecting our individual right to privacy. Why are 3rd party trackers allowed to siphon data from us without our permission? We should selectively be able to reveal what ...
2
votes
1answer
50 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
0
votes
1answer
67 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
0
votes
2answers
265 views

Why not write the CSRF Token into the Session

I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
5
votes
1answer
1k views

How to implement CSRF protection with a cross origin request (CORS)

tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
0
votes
2answers
179 views

Browser session cookies stolen/copied to another PC, why websites not smart enough prevent it?

Just out of curiosity and security test, i copied my own browser's cookies to another pc on same browser and surprisingly i managed to open facebook and google accounts with existing sessions even ...
2
votes
0answers
76 views

Storing credentials in cookies? [closed]

Is there any use case where you would store hashed credentials in a cookie? EDIT I was discussing this problem with a colleague if it's advisable to do this. Since then, I found an example where a ...
3
votes
2answers
493 views

Why not store password in cookie?

I've got a novice question - It is often said that you should not store plaintext passwords in a client-side cookie. (I'm imagining a web browser cookie, but I supposed this applies in general.) But ...