Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user ...

1
vote
0answers
50 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
1
vote
1answer
40 views

Site inaccessible with Cookies turned off in browser [on hold]

Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
1
vote
2answers
55 views

How to implement secure user sessions using HttpOnly cookies?

I'm creating a web application, and want to allow users to log in (and stay logged in). My plan to support this in a secure way goes as follows: User logs in from a login form - when successful, the ...
2
votes
0answers
43 views

Alternative to sensitive data in cookie

My company has a travel app which helps you buy tickets for work related travels. When you need to travel you enter your details on SAP and it it sent to your manager for approval. When it is approved,...
-4
votes
1answer
55 views

Can cookies help hacker to access our activites?

I have read about cookies of browsers. I read that cookies can store our browser's history. Whatever we have searched and whatever we have watched all kind of activities storied in cookies. I also ...
0
votes
1answer
101 views

If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies?

Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? I was asked to ask this as a separate question. This isn't a duplicate question. Okay, so ...
2
votes
1answer
94 views

If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

Ref: How do I report a security vulnerability about a trusted certificate authority? This question involved a serious security vulnerability at WoSign. Here's the finder's blog: http://webcache....
0
votes
1answer
90 views

How to get the cookie of embedded iframe

I'm embedding an iframe on my site < iframe id="demo" src="https://example.com" > example.com has a cookie (not a http-only cookie) How can I get the cookie?
0
votes
1answer
32 views

Whether cross cookie sharing between the android apps is potential threat to privacy?

Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
1
vote
2answers
46 views

Effects of new random Session token for each HTTP Request

On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters. ...
0
votes
1answer
45 views

Secure and HttpOnly flag for load balancer cookie

Is it necessary or recommended to add Secure and HttpOnly flag to load balancer cookies? In my application, I have three cookies: BIGipServer~..., TS01702dcd and IDSESSION, where IDSESSION serves as a ...
83
votes
5answers
20k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
9
votes
3answers
352 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
0
votes
2answers
223 views

JWT or session cookie for API for both web and mobile app?

I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach. The only two requirement are: I need to know the users that are ...
3
votes
0answers
345 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now ...
8
votes
1answer
243 views

What is a “Cookie Swap” password reset attack?

Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here. While I do not like to make these type of posts I ...
3
votes
1answer
136 views

How does Google save authentication information in the browser? [duplicate]

When I open Gmail in the browser, I automatically log in. I believe this is because of the previously saved cookies. If I remove cookies I need to sign in again. It means Google saves some auth keys ...
1
vote
1answer
55 views

How to prevent expired cookies from maintaining accesss?

My company has a website that was recently the target of a security audit. They found that if a hacker had obtained the browser cookies used by our .NET website for authorization, that those cookies ...
1
vote
2answers
109 views

How do I know exactly what type of information Github collects from a visitor?

I keep track of the upload bandwidth on every site that I visit, and I've noticed that the most site that uses upload bandwidth is Github.com every single page that I visit uploads 1.06MB of data. ...
0
votes
2answers
182 views

Do websites outside of the EU need to consider GDPR? [closed]

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...
1
vote
2answers
250 views

Storing OAuth access and refresh tokens in non HttpOnly cookies

I am using OAuth auth code flow to generate access and refresh tokens and then I store them in two browser cookies that are not HttpOnly and send them back too the client. The cookies need to be non ...
0
votes
1answer
105 views

Suspicious Redirect to malicious website

While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared. I clicked on a button in order to locally download an excel sheet (report) that was ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
-3
votes
2answers
139 views

Do cookies violate privacy and should not be used? [duplicate]

Cookies are just a simple text file or DB (some parts encrypted). There is no way to execute them and they cannot access other user data store. Normally cookies keep some data like session ID or ...
0
votes
1answer
101 views

What cookie should have Http-only tag [closed]

I am checking the http-only tag of some webpages and I a have a doubt when I'm trying to check. For example in the following image: There are some cookies with the http-only flag active but I don't ...
0
votes
0answers
92 views

difference between res.header(x-auth, JWTtoken) and res.cookies(JWTtoken)?

I have seen across all blogs and articles is that there is two ways to handle JWTtokens, put them inside localStorage which subjected for XSS attack or put them inside Cookies and set httpOnly and ...
0
votes
0answers
187 views

Storing JWT in cookies vs Authorization: Bearer?

I don't want to store my JWT in localStorage due to XSS, so i want to know the difference between storing JWT in Cookies vs Auth Header
4
votes
2answers
247 views

Why we store session id instead of user id inside cookies?

Would not it be better to store user id instead of session id so that we only lookup database once for extracting other user info instead of twice extracting user id from session db then user db?
0
votes
1answer
99 views

How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]

The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. ...
0
votes
0answers
26 views

How would attackers bypass Token Binding?

Token binding is not easy to implements across organizations to support Bearer Tokens. The problem with Bearer Token is that merely having it even if it was stolen will be enough to use (same idea as ...
2
votes
1answer
230 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
1
vote
1answer
28 views

Security implications of using long lasting authentication cookies

I'm trying to find some information about potential security risks with allowing long lasting cookies for website authentication. Initially it was set to not persist the login session, so it would ...
1
vote
1answer
82 views

Is it possible to send cookies from third party server to browser using CORS

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app ...
-3
votes
2answers
92 views

Is it possible/does there exist a website tracking mechanism besides cookies? [duplicate]

Is it possible/does there exist a website tracking mechanism besides cookies that can stay persistent in such a way that clearing cookies and cache an using a new IP is of no use and can still trace ...
0
votes
0answers
35 views

Can you exploit cookies if a site sets a cookie's value through document.cookie unsanitized?

If there was a site that took a user controlled parameter and did the following, could it be exploited to set other cookies or do anything harmful? document.cookie = "UserWhatever=" + ...
0
votes
1answer
40 views

Is there a way to know that a cookie is “HTTP Only” on the first user request?

As I was reading the session fixation article on OWASP, I was thinking that the only way for my server to refuse a cookie set by a rogue script would be for my server to know that the browser sent a ...
0
votes
1answer
241 views

Import Wireshark Cookies into Firefox?

I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies. Greasemonkey and ...
0
votes
1answer
171 views

How could this SSO implementation possibly work without browser cookies?

Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...
1
vote
0answers
32 views

Parent domain cookies for Single Sign on

Typically Single Sign On is implemented with existing protocols like SAML or OAuth. If all the sites belongs to the same parent domain such as a.example.com and b.example.com, we can also set a ...
1
vote
1answer
49 views

What is the “validity scope” of a browser cookie?

Consider the standard CSRF protection of a Ruby on Rails application: a CSRF token is embedded in the HTML page, while at the same time stored encrypted as part of the session cookie. When making a ...
1
vote
0answers
42 views

Security concerns in cookie exporting between browsers

I'm wondering why Facebook is not handling the cookie export between browsers and related security concerns. This will be worst when they are using the "remember me" option as the cookies will be ...
3
votes
1answer
268 views

Sessions implemented through cookies over HTTPS

I have a question about sessions implemented through cookies. I have just started to learn about security and I apologise if this question comes across as something elementary. Let's say I'm using ...
2
votes
4answers
113 views

How does client-side cookie encryption enhance browser security?

If cookies are stored in plaintext, then any program which has read access to the cookie file can hijack the browser session, which is bad. However, even if cookies are encrypted, the browser must ...
0
votes
1answer
165 views

Cookies Stealing

Is it possible to steal cookies through MITM on 'HTTPS' site if the cookies are missing 'Secure' Flag? Is it possible to steal cookies through MITM on 'HTTP' site if the cookies have 'Secure' Flag?
3
votes
2answers
168 views

Installing own certificate for HTTPS sniffing?

This is something I heard before but cannot remember how to do, I am looking for a tutorial or alike. I have an Android application I need to audit. I need to check if any cookies are being ...
2
votes
2answers
270 views

Use javascript variable instead of session cookie

I have decided to plunge deep into Angular-like technologies, where all pages are practically just one page that gets never reloaded. And at this point I had the idea, instead of using cookies (which ...
8
votes
6answers
1k views

Privacy Policy(ies). Does the cookie “collect” browser data or “request” browser data? [closed]

I'm working on legal portion of my site, Privacy Policy in particular. I've done the research and found that nearly all the answers to my question (below), is generalized. Question: Do cookies "...
9
votes
1answer
629 views

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm ...
0
votes
1answer
931 views

Cookie stealing with Redirection

I am trying to steal cookies for learning purpose and for that I have setup an attacker server where my malicious website is running stealing cookies of users and it works when I visit like http://...
0
votes
1answer
45 views

Why are some cookies/data changes (e.g. via Burp) persistent and some are not?

I am not a developer, so please forgive my ignorance. Can someone explain why some cookies can be manipulated and submitted via Burpsuite proxy and some cannot? Is there something in JS (or whatever ...