Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

How to used HttpOnly cookies [migrated]

I understood the goal of the cookie httpOnly, this system secure against the cookie still because we cannot use document.cookie to get the cookies information (for example XSS attack). I made a POC ...
1
vote
0answers
26 views

Username is present in the cookie [duplicate]

Can the presence of the username in the cookie at every request represent a security problem? If yes, why?
1
vote
0answers
37 views

In memory JWT for API auth with HTTP-only cookie for sessions?

I've spent a while reading about this, and I know it's a common topic, but I was hoping to get some feedback on my authentication approach. I have an SPA. It needs to authenticate to 1) my ...
2
votes
0answers
70 views

Possible cookie attack

I am testing an web application and I found a cookie in which the language of the application is set. Specifically, I have modified one request and I have noticed that all the other requests it makes ...
0
votes
0answers
49 views

Firefox: What would be more secure/private: storing session cookies or saving password in the browser?

I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one ...
0
votes
0answers
15 views

jwt served via httponly cookie with someway to find out is-logged-in [migrated]

While building a javascript SPA (single page application) I need to display some pages differently based on if the user is logged in or not. Auth is handled by JWT which is served via httpOnly ...
1
vote
1answer
73 views

Burp Suite change value cookie

I'm trying to change the value of a cookie using the Burp option, "Match and Replace". Here is my configuration: Item: Request header Match: cookieName:.*; Replace: cookieName:myValue; Type: ...
1
vote
0answers
55 views

Have ad platforms started surveilling and sharing emails and PII?

I was on a webmastering forum and saw an ad that made a disturbing promise. They claimed that if a person makes a casual visit to your web site, they can obtain that person's email address, and ...
0
votes
1answer
84 views

Doesn't Samesite cookie and Sameorigin policy effectively does the same job?

Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is ...
0
votes
2answers
64 views

What is the relationship between cookies and anonymity?

If you are using a vpn for anonymity you can allow cookies when you surf the internet but you must delete them once you close the browser to get complete anonymity. Is this correct? Or is it that ...
0
votes
1answer
93 views

Token and cookie based mechanisms: stateful or stateless, session or nonsession based?

Sorry for being still confused. I hope someone could share how they understand the following questions and also Is session/cookie based authentication stateful or stateless?. There might be some ...
2
votes
1answer
133 views

Is session/cookie based authentication stateful or stateless?

Flask Web Development says The current login functionality implemented with the help of Flask-Login stores data in the user session, which Flask stores by default in a client-side cookie, so the ...
1
vote
1answer
349 views

Is cookie information stored on the server side? [closed]

I thought cookies are stored on client side only, as files. Then I realize if cookies are not stored on server side, how could a server match a cookie just received from a client to some session or ...
1
vote
2answers
44 views

Does HTTP protocol interpret contents of cookies and query strings in URL, whereas it doesn't interpret message bodies?

HTTP knows to look for user names and passwords in authorization headers in HTTP requests. So this is at HTTP level. Is it correct that putting user passwords into message bodies of HTTP requests is ...
1
vote
0answers
43 views

Validating JWT in server-to-auth-server scenario

The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario? I am looking ...
3
votes
1answer
137 views

Should JWT's be validated on every request?

I have been unable to find a definitive answer to the above question. We currently use JWTs from AWS Cognito for our Authentication. Currently the JWTs that are returned are too large to use in ...
0
votes
0answers
46 views

Why SetCookie's SameSite directive applies the destination rather than the origin?

I understand that the SameSite directive tries to protect against cross-origin leakages and CSRFs (see OWASP), but I don't get why (on my browser at least) it applies to the cookie's destination ...
0
votes
1answer
130 views

How did a website make an accurate assumption of my identity in incognito mode? [duplicate]

What piece of information can websites retrieve that would allow for later identification without cookies? Intro Out of interest I jumped into the rabbit hole of online marketing scams. The site I ...
0
votes
1answer
57 views

Sending httpOnly cookie also in HTTP response body

I've done some researches on this topic, and I found this question on SE: Sending session cookie inside the HTTP response body But this answered my question just in part. On login, my server will ...
2
votes
1answer
65 views

Is there any drawbacks of “accepting all cookies” while in incognito mode?

Since the GDPR landed, many websites have to inform you about their cookie usage and give you an option to enable/disable them for provider and for reason of storage. Say that I find a link I want to ...
1
vote
1answer
144 views

Storing third party API tokens in a database

Currently I have a Node JS project that uses the Spotify API. The project displays the users top played artists and tracks. I am following the Authorization Code Flow to obtain the access token. This ...
15
votes
3answers
2k views

For SameSite cookie with subdomains what are considered the same site?

For the samesite cookie attribute I'm not clear on if I set a cookie with domain .example.com from sub.example.com with the samesite attribute, if it will be considered the same site as other.example....
2
votes
1answer
144 views

Encrypting session cookies on an Android device

One of our clients has an issue with a government security audit on one of their mobile applications. The finding states that the application stores session cookies on the device in clear text format ...
-3
votes
1answer
107 views

What led to the prominence of storing JWTs in localstorage?

Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
2
votes
1answer
340 views

How do you securely delete httpOnly cookies previously used for login?

I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the ...
2
votes
1answer
100 views

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute. ...
0
votes
0answers
58 views

Is the “same registrable domain” a sound security basis for cookies?

Unlike other Web standards, HTTP cookies don't use the common definition of the "origin" as with the "same origin policy"; cookies are segregated by domain names and subdomains. (And there is the ...
1
vote
2answers
84 views

Session ID containing username?

Is it safe to append the user's username to the session ID? The session ID is 32 bytes long generated using a secure PRNG. I encode it using base64 URL to save it in a HttpOnly cookie. The cookie ...
-1
votes
1answer
123 views

Privilege escalation modifying cookie

I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...
1
vote
0answers
119 views

Hardening ASP.NET against session fixation: Should I change the session ID despite the additional Auth cookie?

Situation I am the responsible developer for an ASP.NET application that uses the "Membership" (username and password) authentication scheme. I am presented with the following report from a ...
0
votes
2answers
111 views

Baking a better cookie - How can we prevent a high-jacking of the user's local cookie file to exploit accepted cookie use?

This question is similar to Hashing cookie-values & preventing cookie-stealing however, it is significantly different as I am interested in preventing (internal) subscription fraud, rather than an ...
0
votes
1answer
69 views

Exploiting CORS and storing the response to server

I am trying to exploit misconfiguration CORS. I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the ...
83
votes
5answers
15k views

How does Facebook track your browsing without third party cookies?

Facebook has served me an ad for a website I visited earlier in the day. I have third party cookies disabled and have not followed any links between the website and Facebook (links which could contain ...
1
vote
0answers
40 views

What relative functionality needs to be implemented when users click an “Accept Cookies” button? [closed]

As of 2018, a recent security measure was passed, called 'The Cookie Law'. It states that; if you have a website or blog with visitors from the EU (which is likely to happen), "you need a cookie ...
0
votes
0answers
41 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
1
vote
1answer
306 views

Preventing CSRF with SameSite=“strict” without degrading user experience?

ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks: https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
2
votes
1answer
162 views

Security Risk of Stolen Session ID vs Authentication Token

I was intrigued by the discussion of this SO question as well as the accompanying blog post. I'm trying to better understand the mechanics of the two systems, and one of the questions I came up with ...
0
votes
0answers
21 views

Intra-domain Session Management Using Cookie

I need some guidance on a solution I am building. I have a mega/super domain (e.g. .example.com). I need the users to be able to log into a subdomain (e.g. central.example.com) and maintain their ...
1
vote
0answers
664 views

Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution

I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
0
votes
1answer
169 views

Is it secure to use a hash of a login token as an anti-csrf token?

Alright here is my proposal: Use a hash of a login token as the anti-CSRF token. Why this is a good idea? Prevents having to store anything extra on the client, the server, and less network traffic ...
0
votes
1answer
60 views

Secure Cookie on HTTP site

I was asked this question "If the cookie is marked secure and the web application is over http , Cannot we access the application ?" Considering the secure flag is to ensure the cookie is sent only ...
0
votes
1answer
87 views

Crack a single http cookie and gain access to a random user's account! [duplicate]

I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
3
votes
1answer
86 views

Cookie without secure flag but with httponly

I have a cookie that is httponly but without the secure flag. Under this condition, can an attacker capture the cookie, although the site is only on HTTPS?
1
vote
1answer
183 views

Having problems with performing a JWT “none” algorithm attack

I'm taking a course where I must breach a site which uses 2015 version of JWT for authentication. They gave me the test//test login information and I must login with admin. After I log in, I receive ...
2
votes
0answers
121 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
0
votes
0answers
56 views

How to Stop Cookies from Being Set

We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
2
votes
1answer
133 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
0
votes
1answer
86 views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
1
vote
1answer
136 views

What can happen if my Flask SECRET_KEY becomes public?

I use OpenID Connect to let my users login. What could happen if Flasks SECRET_KEY becomes public?
1
vote
1answer
577 views

XSS in iframe can't access document cookies

I know of a website, lets call it website.com, that has these vulnerabilities: iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...

1
2 3 4 5
13