Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
0 votes
1 answer
39 views

Running blog under /blog, security considerations

I'd like to set up a self-hosted Ghost.org blog for a SaaS. I have two options: example.com/blog blog.example.com Everywhere I read they recommend the /blog for SEO. However, I'm concerned about the ...
hyperknot's user avatar
  • 101
1 vote
0 answers
47 views

Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation

I have a website that includes CSP rules: .use( helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: [ "'self'", "cdnjs....
EPiez's user avatar
  • 13
0 votes
0 answers
64 views

httpOnly Session Cookies in an iframe context in the future w/o SameSite=None

My website is using session cookies (w/ SameSite=Lax, secure, httpOnly attributes) and a CSRF Token stored in localStorage. Recently I developed a teams app, which essentially loads the website ...
user4503817's user avatar
0 votes
1 answer
116 views

Is it possible to trick a user into logging in to a site, then stealing a non HttpOnly cookie that will be set after they log in?

If a user has already logged in, and then the site sets a non HttpOnly cookie, then it seems possible to trick the user into doing something that would lead to the cookie being stolen. If the cookie ...
ETLJ's user avatar
  • 11
0 votes
1 answer
79 views

how to send cookies or token in local storage to a remote server using reflected XSS

I have an XSS vulnerability identified by <script>alert(1);</script> in the url. So when I put it in the url it gets executed (ex: www.example.com/admin/<script>alert(1);</script&...
anonymous's user avatar
2 votes
1 answer
91 views

Does saving the cookie or jwt token in the browser raise a security risk?

I have an admin screen, once I access it, it asks for login credentials, then after I login, I get a token that is saved under local storage (see screenshot below) Noting that I am using edge browser ...
anonymous's user avatar
0 votes
1 answer
229 views

Secure access and refresh token handling in a SPA

I am trying to figure out how to handle access and refresh tokens securely on the front end in a SPA. After doing a lot of reading, I still have questions/doubts about the proposed solutions I found ...
tech-ebe's user avatar
1 vote
0 answers
96 views

Session/cookie expire time, match access token or refresh token from AD?

I am tasked with moving away from implicit flow in a SPA. It is a basic solution consisting of a react SPA and a .net API, on the same domain. This web app is a case management solution that deals ...
ryansan's user avatar
  • 113
0 votes
0 answers
190 views

Lax SameSite and POST (2 minute)

I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has ...
Johnny's user avatar
  • 183
0 votes
1 answer
116 views

Double Submit Cookie Bypass

I am trying to work on an example for my class on how double submit cookie works and how attackers can bypass it The idea i have is I have two domain att.com and victim.com. The login functionality on ...
Johnny's user avatar
  • 183
4 votes
2 answers
1k views

HTTPonly token without CSRF is safe?

How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible? for example, to be ...
H01F's user avatar
  • 43
2 votes
0 answers
147 views

Storing bearer token in cookie for file retrieval in another tab

The existing system involves storing the bearer token in a cookie to fulfill a customer request of not only downloading an attachment within the application but also opening it in another tab. This is ...
Greg's user avatar
  • 121
7 votes
3 answers
2k views

Is storing authentication tokens in local storage with a strong CSP safe?

Whenever the topic comes up, almost every source recommends to never store authentication tokens in a place where they can be accessed by client-side Javascript. The recommendation is almost always to ...
Mad Scientist's user avatar
1 vote
1 answer
106 views

Why wouldn't a site's cookies be sent in this scenario?

I'm reading an article on Okta's engineering blog, which contains the following paragraph: Some of the disadvantages of cookies include: Cross-site request forgery attacks (XSRF or CSRF): CSRF ...
Richie Thomas's user avatar
0 votes
2 answers
277 views

What are Cookies SQL injection?

After applying web vulnerability scan on a site that I have, I found a vulnerability called Cookie SQL injection, and applied on the requested cookie. What is this vulnerability? and how can I solve ...
user avatar
1 vote
1 answer
358 views

Is prohibiting cookies a viable CORS alternative?

I have been using lots of various APIs in my frontend lately and they all have to be properly configured with CORS and the browser always do extra OPTIONS request that only make debugging harder. I ...
Ilya Chernomordik's user avatar
3 votes
1 answer
446 views

OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header

I'm exploring the possibility of implementing OpenID Connect (OIDC) with an HTTP-only cookie to keep my frontend code completely authentication-agnostic, instead of passing the Authorization header ...
Luke 10X's user avatar
  • 131
1 vote
1 answer
164 views

Does not storing passwords in browser really matter given cookie hijacking exists?

I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too. But then I found out about ...
Arthur Moraes Do Lago's user avatar
0 votes
1 answer
145 views

token leak by copying cookie

Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
Jacson - ANLS's user avatar
0 votes
1 answer
131 views

Authentication that immune to cookie hijacking [duplicate]

There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability. ...
Ghost Rider's user avatar
0 votes
0 answers
167 views

do I need anti-csrf-tokens or double submit cookie pattern?

currently I'm working on a NestJs backend. I have already implemented the auth feature with jwt (access and refresh) stored in cookies. Originally I sent the jwt by the standard Bearer token way in ...
derstauner's user avatar
1 vote
1 answer
1k views

Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?

Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
DevelJoe's user avatar
  • 141
0 votes
1 answer
170 views

Is using two cookies one Lax and one Strict a way to improve usability without compromising security?

My understanding is that Strict is the best as, admitting you have a recent browser, it completely replaces the need for CSRF Token. Strict is however a big hit on usability as things like SSO or ...
allan.simon's user avatar
1 vote
0 answers
238 views

How to ignore asterisk characters in sqlmap?

I've come across a webpage that uses Iron cookies. These cookies have the exemplary format: Fe26.2**0cdd607945dd1dffb7da0b0bf5f1a7daa6218cbae14cac51dcbd91fb077aeb5b*aOZLCKLhCt0D5IU1qLTtYw*...
Andres R's user avatar
0 votes
2 answers
162 views

Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?

When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
colioli's user avatar
0 votes
1 answer
120 views

How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?

When a user logs in with their email/password combo and gets authenticated to our website, the backend sends the web browser an encrypted cookie based off of their memberId with us. While this ...
user1068636's user avatar
1 vote
1 answer
266 views

What sort of cookie is this website giving users

I am doing some research into scam websites (particularly the ones where you receive a text message telling you you have an undelivered package, or unpaid tolls etc and they provide you with a link to ...
user2334659's user avatar
0 votes
1 answer
885 views

Identifying a session hijacking attack [closed]

I understand session hijacking has been a widespread attack vector in the past months. If an attacker steals a user’s session cookies, they can bypass 2FA and login/password. If this is the case, how ...
Mark O's user avatar
  • 3
0 votes
0 answers
4k views

Decrypting Browser Cookies

So I am trying to write my own backdoor with python and it is something like Metaploit, where you can run a single command and it would do the work for you, so I am trying to implement a cookie ...
LuckyCoder3607's user avatar
2 votes
1 answer
344 views

Should I return JWT tokens on a login route even if I am using cookies?

I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to ...
Jaanis's user avatar
  • 21
1 vote
1 answer
9k views

Where to store JWT refresh tokens

Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
simple_developer's user avatar
0 votes
1 answer
110 views

Passing user identity to a different REST service

I have two use-cases I am trying to solve. A HTTP Service-A hosted on XYZ domain tries to access HTTP Service-B on ABC domain. Service-B is a stateless HTTP API which does not have user concept. ...
Sunil Dabburi's user avatar
1 vote
1 answer
404 views

AES ECB cookie bypass

I am currently participating in a CTF Challenge and have reached a stage where I discovered a "log_admin" page. This page generates a cookie that is encrypted using AES 128 ECB. I obtained ...
user294797's user avatar
1 vote
0 answers
147 views

SSO Using API based login (not through UI redirection)

We have 3 different applications which have the same top level domain. a.example.com b.example.com example.com We have a login mechanism where the user provides a username + password and logs in. ...
gaurav5430's user avatar
1 vote
2 answers
7k views

Set cookie inside iFrame domain not seen

I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
Los Sol's user avatar
  • 11
0 votes
0 answers
87 views

Options for various auth strategies for express API

OK, I need some help with this: I am creating a Node express API, and I want to support the following auth strategies: Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for ...
prmph's user avatar
  • 227
0 votes
1 answer
173 views

How does Android/Firefox authenticate the Android Pocket app, for example?

I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. ...
sourcejedi's user avatar
2 votes
1 answer
357 views

Logout is just clearing cookies [closed]

My friend who is a web developer implemented his session management in a totally new way for me. He created a random sessionAPPID that is given to the user when he gives correct credentials. He then ...
rudeus123's user avatar
0 votes
0 answers
859 views

best way to keep user logged in with cookie and jwt?

I'm making an SPA with Laravel REST API and trying to keep it stateless. Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality. On successful login the client ...
Bufer's user avatar
  • 11
2 votes
2 answers
644 views

How to implement Double Submit Cookie with Encryption or HMAC

I'm trying to implement the Double Submit Cookie pattern with extra protection using encrypted or signed CSRF tokens. I'm working with a Single Page Application and a stateless API. The purpose of ...
AFP_555's user avatar
  • 121
0 votes
1 answer
294 views

Google Security Cookies; Prevents cookie leak to malicious XHRs

Below is an excerpt from https://policies.google.com/technologies/cookies#security The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a browsing session are made by the user, and not ...
Aadithya V's user avatar
0 votes
1 answer
115 views

Why does a page opened via https send an http cookie when I log in? [closed]

I use Brave browser with VPN, I also set it to only allow https. When I log in to my Gmail account, I see http cookies in the security part of the Brave browser. As far as I know, http cookies are not ...
SfcScan's user avatar
1 vote
0 answers
579 views

How does a website know if i've visited it before? (and how to bypass that) [closed]

For example: https://pdfcandy.com/pdf-ocr.html has a limit on how many times I can use a feature per hour, but if I use an incognito tab I can easily bypass that. But with https://ichigoreader.com/...
Kamisama's user avatar
0 votes
3 answers
382 views

Do browser vendors have access to LocalStorage/cookies?

Question is pretty much in the title. We have a customer that is very concerned with privacy, and we're making a solution that will rely on data being stored in LocalStorage, so we just need to verify ...
peirix's user avatar
  • 103
1 vote
0 answers
115 views

Storing auth token in html

Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
Sam's user avatar
  • 11
2 votes
1 answer
1k views

Is it possible to steal a cookie without HttpOnly via CSRF?

Without giving too many details away, let's say that I'm auditing an API that: Has access-control-allow-credentials: true Has access-control-allow-origin: * Needs JWT set in Authorization header for ...
JulianGR's user avatar
2 votes
1 answer
686 views

Cookie flow in a site that hosts embedded Youtube video

When there's a Youtube video embedded on a site that I visit while I am logged in Youtube beforehand,how does the embedded video know that it's me so I can add it to my Watch Later list? I think the ...
microwth's user avatar
  • 2,473
2 votes
0 answers
97 views

Auth Token not included in CORS exploit [closed]

I have found a CORS on a website but when I am trying to exploit it for a POC it is fetching all the cookies except auth cookies and due to that I am getting an error message to "User not logged ...
Abhinav Kumar's user avatar
1 vote
2 answers
239 views

Are there any security reasons against "drop-www" (using example.com instead of www.example.com)?

Are there any security reasons against "drop-www"? In other words, are there any security reasons against using an apex [1] domain name such as example.com instead of a subdomain such as www....
adrelanos's user avatar
  • 764
1 vote
1 answer
201 views

Can websites, through cookies or other usual means, access PDFs opened in browser?

Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
AndroidUser558's user avatar

1
2 3 4 5
17