Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
2
votes
1answer
67 views

“Trusting” the Host header in a port-forwarding environment

A similar question has be answered here already, but I have a very specific scenario in which it didn't fulfil my requirements. I am setting up an environment which includes a web-service running on ...
1
vote
1answer
60 views

Would “same-origin cookies” make sense?

I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on. ...
0
votes
1answer
31 views

Reverse-proxy issues

I am trying to create a reverse-proxy web application using Flask. I don't really know weather to call it reverse-proxy or not but my idea is that the web app gets a URL from ../proxy/<URL>, ...
0
votes
1answer
61 views

Can yubikeys prevent cookie stealing?

When you log into a website, it stores cookies that let your browser access the website without having the password. Given that some sites support yubikey for login, does it mean that the yubikey ...
1
vote
1answer
51 views

How do you make sure a session token is expired when a browser might use “session restore”

I was reading this article about session tokens from Mozilla's Developer website. Historically, I've always assumed that a session token set with a blank expiry (or one set to zero) would expire at ...
0
votes
0answers
3 views

Why does the browser show a different CSRF value to my form [migrated]

This is Chrome and the value on the right never changes despite page reload showing a different value on the form each time. Safari does the same thing though with a different (static) value. Question ...
0
votes
1answer
40 views

Should the server send 'secure' cookies on unsecured http response?

I noticed that the module cookie-parser in NodeJs sends back cookies that have the "secure" attribute set, even in an unsecured http response. They have specified this behavior in their ...
0
votes
0answers
53 views

Block Cross-Origin requests for Youtube embedded video (with js api)

I am developing webpage in which I am embedding some Youtube video's. On my localhost environment I get the following errors: "Cross-Origin Request Blocked: The Same Origin Policy disallows ...
0
votes
1answer
57 views

Does copying cookies allow attackers to view pages that should be visible only after login?

TLDR; Copying the request from ChromeDevTools along with all cookies allows me to view pages that I should not be able to view after logging in. Have I been pwned ? I just found a terrifyingly easy ...
0
votes
0answers
45 views

Redirection from backend with frontend using OAuth token with Cookie

Currently, Can you provide your suggestion, whether my below approach is good with security perspective. User clicks on login button which calls backend/api/login Step1 triggers the oauth flow and ...
0
votes
1answer
66 views

Setting httponly secure cookies in microservice architecture

I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks. When a user goes to my website they may make an api call ...
0
votes
2answers
74 views

Can cookies with a complicated secret be manipulated?

Im currently working on a personal full stack application using cookies with the express-session middleware. Theyre secured with some sort of secret. Im not really too sure how that works but I think ...
1
vote
2answers
64 views

Will making HTTP cookies unique to a given website make cookies aligned with the strictest privacy guidelines?

As far as I know, the only privacy problem with cookies is that in general, the owners of website Y could read what a visitor has searched for or had done in website X. Will making HTTP cookies unique ...
0
votes
0answers
72 views

Using HMAC signed cookies instead of JWT for authentication

Since most people seem to caution against storing JWT tokens in the localStorage and recommend keeping them in the HttpOnly cookies, in this case I don't really see the advantage of using JWT auth. ...
0
votes
0answers
51 views

XSS with Java to get User Cookies

I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information. I am following the instructions in this Lab for the XSS Attack. We are ...
0
votes
1answer
89 views

Default behavior cookie flags in 2021

I'm under the understanding that in 2019, Chrome and Firefox both planned to move to SameSite=lax default for all unspecified cookies. In addition, recently, Chrome decided to set defaults based on ...
0
votes
1answer
136 views

Is ProtonMail implemented a mechanism to prevent cookies stealing?

I want to check if I can steal my own ProtonMail cookies. I connect to my account, I delete the cookie named AUTH-x12334xxxaazzzrf6567788ddd (cookie name is randomized name). I refresh the page and as ...
1
vote
3answers
67 views

Current session cookie shown in a HTML page on request

A website exposes this function: https://test.com/getSessionCookie When an authenticated user clicks on it he gets an html page with his cookie. Could be this exploited in some ways?
0
votes
0answers
363 views

CRSF protection in Next.js applications

So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though: The library saves the CSRF token as ...
0
votes
0answers
60 views

How to handle Antiforgery on Multiple ASP.Net Core APIs and Angular SPA

I am using an Angular SPA which calls multiple Asp.Net Core APIs. I need to enable Antiforgeryvalidation in all APIs and all requests should be validated. 1.) Products API hosted mydomain.com/api/...
1
vote
0answers
54 views

Facebook retargeting pixel

Given a commercial website buy.com and a user with a Facebook account in facebook.com, the user has third-party cookies disabled in the browser. If a user is logged in their Facebook account and ...
0
votes
0answers
144 views

JWT token. Send in a cookie or Auth header depending on Rest vs MVC?

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far? When on a traditional MVC app ,do you send the token inside a ...
0
votes
0answers
15 views

What does this obfuscated PHP script do? [duplicate]

I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake. The script in it's original form looks like this: $zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
1
vote
0answers
83 views

httpOnly Cookie Security Flaw

I'm bit confused about this security flaw. I'm in real need of help in this :smile: My express code (not using any sessions, just cookie-parser) app.get("/signin", (req, res) => { if(!...
1
vote
1answer
52 views

How secure is to authorize a website to “trust your device”?

A bank has a form of 2FA where, after you put in your username and password, they send a code via SMS to your mobile phone and you have to put that too. On the screen asking for the SMS code, there ...
2
votes
2answers
407 views

Exposed my browser cookie of my request header

I exposed my browser cookie of my request header in a web forum. After I realized what I have done - I logged out, cleared my browser and logged in again. Am I safe now? Can someone still use that ...
0
votes
2answers
55 views

JWT is being sent in cookies, but when I try for CSRF they are not sent

I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT. I was under the ...
1
vote
2answers
66 views

Cookie-to-Header CSRF protection vs CORS

What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario? Example scenario: A rest API called api.com provides data to good.com. api.com has allowlisted ...
0
votes
0answers
40 views

Path of Set-Cookie HTTP Response Header

The Tangled Web notes: URL paths are not taken into account during same origin policy checks and, therefore, do not form a useful security boundary Given that, is there any reason to set the Path or ...
1
vote
1answer
68 views

Is Google cookie a first-party cookie?

Recently, after blocking third-party cookies, I thought that all non-domain cookies will be blocked. But as a surprise Google (google.com) cookies are not removed even if there is no link between the ...
1
vote
0answers
56 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
0
votes
0answers
134 views

Why does using JWT refresh tokens protect against CSRF during authentication?

I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance ...
1
vote
1answer
232 views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...
1
vote
1answer
64 views

Mitigating physical cookie theft

Threat model: Malicious user gaining physical access to browser cookies (e.g., 3rd party repair guy copying cookies to his own device or something like that). Let's say legit user did not clear ...
0
votes
0answers
50 views

Security idea for storing JWT tokens, is this a good idea?

I have been reading a lot about where you should store your JWT tokens for web applications. Local storage and cookies has its pros and cons. So I thought that maybe it could be a good idea to instead ...
0
votes
0answers
47 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
1
vote
0answers
46 views

Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]

Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
1
vote
2answers
135 views

Does a professional website know that person A switches the Chrome “user” and logged into its website with another email address?

Let's say I have account A on site example.com that has a policy of strictly one account per real person. I then create a new Gmail address, use that Gmail address to open a new Chrome user (not ...
0
votes
0answers
279 views

CTF XSS Session Hijacking

I'm playing a complete noob in terms of security but a friend invited me to play a internal CTF for my company and I'm stuck with this challenge. I have a simple website that goes as follows: http://...
1
vote
1answer
63 views

Based on cookies, does a website knows that a user visited it if the user does not log in?

I, user ABC, have an account on some financial website example.com. I have logged in from my browser many times before so cookies were saved. Each time I would log off after I finish browsing that ...
0
votes
0answers
25 views

Authentication Cookie Security Features

I am completely stuck and I need to make sure that I am correct. Any help is greatly appreciated. Based on the cookie, I need to answer these questions: Select which security features does the cookie ...
0
votes
1answer
36 views

Account switcher in browser implementation and secure design

I am trying to understand how websites implement in-browser account switcher. e.g you can login to twitter using multiple accounts. On the bottom left when you click your currently logged in account, ...
1
vote
1answer
56 views

What you can do with super cookies on subdomain to harm domain?

When you search in Google for user cookies top results are VPN services that say that it's used by ISP to track the users. Wikipedia Supercookie say nothing about HTTP headers and what exactly are ...
1
vote
1answer
70 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
8
votes
2answers
476 views

Why does Spring Security unset and set the same Cookie in one Request?

In the CSRF implementation of Spring Security (https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java#...
1
vote
1answer
197 views

Does incognito mode prevent cookie-theft attacks?

A fresh incognito browser will not have access to any cookies An active session however, will surely save cookies somewhere so I don't have to login to gmail every time I access gmail.com in the same ...
0
votes
1answer
45 views

Is there a way to modify the value of a session token with HttpOnly flag set in this scenario?

SCENARIO: When a user browses to the login page the web application sets SESSIONID=X; Httponly; before the authentication. After the authentication NO new cookies are set. The only cookie used to ...
1
vote
0answers
184 views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
0
votes
3answers
409 views

Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain

I have three domains but the same code base (Domain X, Domain Y, Domain Z) and Accounts website A If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
0
votes
0answers
130 views

Execute sqlmap in a javaScript object cookie

I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap. Cookie looks like javascript object ...

1
2 3 4 5
15