Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

2
votes
0answers
62 views

Storing credentials in cookies? [closed]

Is there any use case where you would store hashed credentials in a cookie? EDIT I was discussing this problem with a colleague if it's advisable to do this. Since then, I found an example where a ...
0
votes
0answers
26 views

SYN Cookies Limitation [closed]

SYN cookies do not ordinarily allow the use of the TCP options field, since this information is usually stored alongside SYN queue entries. What does it mean? Why it is considered as a limitation?
3
votes
2answers
193 views

Why not store password in cookie?

I've got a novice question - It is often said that you should not store plaintext passwords in a client-side cookie. (I'm imagining a web browser cookie, but I supposed this applies in general.) But ...
1
vote
1answer
70 views

How can CSRF POST happen?

I realise this is a newbie question but when it comes to this im clearly that. On a browser, assuming one received a cookie from site A. Then a different site B makes a call to site A through it's ...
0
votes
1answer
121 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
1
vote
0answers
55 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
0
votes
1answer
33 views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
0
votes
2answers
84 views

modifying an httponly cookie before sending the request

can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie. If yes, then how? I know modern browsers don't allow this. But if you could,...
0
votes
2answers
61 views

Authenticated Sessions on a Desktop Application

I want to implement a login into my C++ desktop application and I'm having a hard time finding information on managing login sessions without cookies or JWT (JSON Web Token) (more on that in a bit). I ...
0
votes
1answer
74 views

Not destroying cookies at log out

As a beginner pentester, I was pentesting one of our applications and found that the cookies are not getting destroyed when a user log outs. The cookies did come with an expiration time and date. ...
1
vote
0answers
15 views

Is HSTS necessary or can I just write .htaccess code to always redirect http to https? [duplicate]

Is HTTP Strict Transport Security (HSTS) necessary or can I just write regular .htaccess code to always redirect http to https?
1
vote
0answers
112 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
1
vote
1answer
43 views

Site inaccessible with Cookies turned off in browser [closed]

Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
1
vote
2answers
66 views

How to implement secure user sessions using HttpOnly cookies?

I'm creating a web application, and want to allow users to log in (and stay logged in). My plan to support this in a secure way goes as follows: User logs in from a login form - when successful, the ...
2
votes
0answers
54 views

Alternative to sensitive data in cookie

My company has a travel app which helps you buy tickets for work related travels. When you need to travel you enter your details on SAP and it it sent to your manager for approval. When it is approved,...
-4
votes
1answer
60 views

Can cookies help hacker to access our activites?

I have read about cookies of browsers. I read that cookies can store our browser's history. Whatever we have searched and whatever we have watched all kind of activities storied in cookies. I also ...
0
votes
1answer
106 views

If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies?

Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? I was asked to ask this as a separate question. This isn't a duplicate question. Okay, so ...
2
votes
1answer
357 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
0
votes
1answer
248 views

How to get the cookie of embedded iframe

I'm embedding an iframe on my site < iframe id="demo" src="https://example.com" > example.com has a cookie (not a http-only cookie) How can I get the cookie?
0
votes
1answer
43 views

Whether cross cookie sharing between the android apps is potential threat to privacy?

Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
1
vote
2answers
50 views

Effects of new random Session token for each HTTP Request

On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters. ...
0
votes
1answer
59 views

Secure and HttpOnly flag for load balancer cookie

Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a ...
83
votes
5answers
20k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
9
votes
3answers
374 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
0
votes
2answers
598 views

JWT or session cookie for API for both web and mobile app?

I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach. The only two requirement are: I need to know the users that are ...
3
votes
0answers
401 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now ...
8
votes
1answer
260 views

What is a “Cookie Swap” password reset attack?

Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here. While I do not like to make these type of posts I ...
3
votes
1answer
259 views

How does Google save authentication information in the browser? [duplicate]

When I open Gmail in the browser, I automatically log in. I believe this is because of the previously saved cookies. If I remove cookies I need to sign in again. It means Google saves some auth keys ...
1
vote
1answer
65 views

How to prevent expired cookies from maintaining accesss?

My company has a website that was recently the target of a security audit. They found that if a hacker had obtained the browser cookies used by our .NET website for authorization, that those cookies ...
1
vote
2answers
119 views

How do I know exactly what type of information Github collects from a visitor?

I keep track of the upload bandwidth on every site that I visit, and I've noticed that the most site that uses upload bandwidth is Github.com every single page that I visit uploads 1.06MB of data. ...
0
votes
2answers
192 views

Do websites outside of the EU need to consider GDPR? [closed]

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...
1
vote
2answers
381 views

Storing OAuth access and refresh tokens in non HttpOnly cookies

I am using OAuth auth code flow to generate access and refresh tokens and then I store them in two browser cookies that are not HttpOnly and send them back too the client. The cookies need to be non ...
0
votes
1answer
111 views

Suspicious Redirect to malicious website

While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared. I clicked on a button in order to locally download an excel sheet (report) that was ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
-3
votes
2answers
142 views

Do cookies violate privacy and should not be used? [duplicate]

Cookies are just a simple text file or DB (some parts encrypted). There is no way to execute them and they cannot access other user data store. Normally cookies keep some data like session ID or ...
0
votes
1answer
166 views

What cookie should have Http-only tag [closed]

I am checking the http-only tag of some webpages and I a have a doubt when I'm trying to check. For example in the following image: There are some cookies with the http-only flag active but I don't ...
0
votes
0answers
240 views

difference between res.header(x-auth, JWTtoken) and res.cookies(JWTtoken)?

I have seen across all blogs and articles is that there is two ways to handle JWTtokens, put them inside localStorage which subjected for XSS attack or put them inside Cookies and set httpOnly and ...
4
votes
2answers
411 views

Why we store session id instead of user id inside cookies?

Would not it be better to store user id instead of session id so that we only lookup database once for extracting other user info instead of twice extracting user id from session db then user db?
0
votes
1answer
100 views

How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]

The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. ...
2
votes
1answer
348 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
1
vote
1answer
31 views

Security implications of using long lasting authentication cookies

I'm trying to find some information about potential security risks with allowing long lasting cookies for website authentication. Initially it was set to not persist the login session, so it would ...
1
vote
1answer
208 views

Is it possible to send cookies from third party server to browser using CORS

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app ...
-3
votes
2answers
99 views

Is it possible/does there exist a website tracking mechanism besides cookies? [duplicate]

Is it possible/does there exist a website tracking mechanism besides cookies that can stay persistent in such a way that clearing cookies and cache an using a new IP is of no use and can still trace ...
0
votes
1answer
40 views

Is there a way to know that a cookie is “HTTP Only” on the first user request?

As I was reading the session fixation article on OWASP, I was thinking that the only way for my server to refuse a cookie set by a rogue script would be for my server to know that the browser sent a ...
0
votes
1answer
356 views

Import Wireshark Cookies into Firefox?

I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies. Greasemonkey and ...
0
votes
1answer
186 views

How could this SSO implementation possibly work without browser cookies?

Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...
1
vote
0answers
40 views

Parent domain cookies for Single Sign on

Typically Single Sign On is implemented with existing protocols like SAML or OAuth. If all the sites belongs to the same parent domain such as a.example.com and b.example.com, we can also set a ...
1
vote
1answer
66 views

What is the “validity scope” of a browser cookie?

Consider the standard CSRF protection of a Ruby on Rails application: a CSRF token is embedded in the HTML page, while at the same time stored encrypted as part of the session cookie. When making a ...
1
vote
0answers
43 views

Security concerns in cookie exporting between browsers

I'm wondering why Facebook is not handling the cookie export between browsers and related security concerns. This will be worst when they are using the "remember me" option as the cookies will be ...
3
votes
1answer
285 views

Sessions implemented through cookies over HTTPS

I have a question about sessions implemented through cookies. I have just started to learn about security and I apologise if this question comes across as something elementary. Let's say I'm using ...