Skip to main content

Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
22 votes
2 answers
17k views

Double Submit Cookies vulnerabilities

Is the Double Submit Cookies mechanism vulnerable anything other than XSS and sub-domain attacks? All CSRF protection mechanisms are vulnerable to XSS, so that's nothing new. I'm just wondering if I ...
Gili's user avatar
  • 2,169
40 votes
1 answer
8k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
makerofthings7's user avatar
53 votes
2 answers
25k views

Will same-site cookies be sufficient protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
Mirsad's user avatar
  • 10.2k
131 votes
4 answers
118k views

Do I need CSRF token if I'm using Bearer JWT?

Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
Igor Pomogai's user avatar
  • 1,413
127 votes
3 answers
178k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
Hoax's user avatar
  • 2,775
55 votes
1 answer
43k views

Why use an authentication token instead of the username/password per request?

The author of https://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
Gili's user avatar
  • 2,169
20 votes
5 answers
21k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
Abe Miessler's user avatar
  • 8,185
38 votes
4 answers
26k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
onlinespending's user avatar
18 votes
2 answers
15k views

Is it safe to store the password hash in a cookie and use it for "remember-me" login?

I want to store an encrypted string of the password hash in a cookie and use the hash to lookup the user and log them in (if they want to be remembered). Is this safe? The password is one-way hashed ...
Mohamad's user avatar
  • 477
6 votes
5 answers
27k views

Store username in cookie for a web site

I want to store the username for a web site in the coockie, is it secure? What an hacker can do with this info?
Jon smith optional's user avatar
91 votes
5 answers
21k views

How does Facebook track your browsing without third party cookies?

Facebook has served me an ad for a website I visited earlier in the day. I have third party cookies disabled and have not followed any links between the website and Facebook (links which could contain ...
Jesse's user avatar
  • 761
90 votes
7 answers
68k views

Does a CSRF cookie need to be HttpOnly?

We were recently handed a security report containing the following: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix ...
alecxe's user avatar
  • 1,615
55 votes
3 answers
43k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
Angular noob's user avatar
51 votes
3 answers
115k views

How can I check that my cookies are only sent over encrypted https and not http?

I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be ...
Jonas's user avatar
  • 5,213
47 votes
7 answers
29k views

Why isn't stealing cookies enough to authenticate?

I tried to export all my cookies through the 'Edit This Cookie' extension on a logged-in page which uses cookie authentication. While logged out I tried inserting those cookies hoping that I would be ...
Kartikey singh's user avatar
42 votes
4 answers
32k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
Joony's user avatar
  • 521
39 votes
6 answers
32k views

Secure Session Cookies

While looking up methods for creating secure session cookies I came across this publication: A Secure Cookie Protocol. It proposes the following formula for a session cookie: cookie = user | ...
ohmu's user avatar
  • 480
8 votes
1 answer
2k views

Identifying, analyzing, and predicting weak session cookies

To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester. Many times I have seen web applications that I know have weak cookies. I can tell this because I can ...
tifkin's user avatar
  • 241
4 votes
2 answers
25k views

What is actually the purpose of encrypting the values in a cookie?

I was researching on internet security. When I reached at section Cookies, I happened to read that the values inside a cookie are generally stored only after encrypting them. But an encryption can be ...
Anandu M Das's user avatar
  • 2,067
67 votes
5 answers
130k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
Jonathan Egerton's user avatar
34 votes
6 answers
33k views

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

With reference to some security paper I read, I found out that a cookie with the secure flag set can only be sent by the client over connections that are using HTTPS, not HTTP, but the cookie itself ...
mfs's user avatar
  • 541
30 votes
5 answers
18k views

Protecting against cross-subdomain cookie attacks

I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
F21's user avatar
  • 511
22 votes
3 answers
11k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
makerofthings7's user avatar
17 votes
2 answers
9k views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...
Leo Jiang's user avatar
  • 313
15 votes
5 answers
12k views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
ManRow's user avatar
  • 425
15 votes
2 answers
7k views

Is there a way to prevent hackers from using cookies to bypass two step verification?

Let's take Steam/Google/FB/Microsoft/Twitter logins as examples. All of them offer two step verification through SMS message. Let's say the hacker does not have access to my phone. But he has access ...
Steve's user avatar
  • 343
14 votes
3 answers
23k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
Jarrod Everett's user avatar
11 votes
5 answers
6k views

What do the various browser "private modes" do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito Mode"...
chao-mu's user avatar
  • 2,821
11 votes
2 answers
2k views

When are HTTP session cookies at risk over Wi-Fi?

If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties? Are cookies only at risk during login, or am I at risk ...
Chesnokov Yuriy's user avatar
6 votes
1 answer
4k views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
JLawrence's user avatar
6 votes
1 answer
7k views

What are HSTS Super Cookies?

A few questions : What are HSTS super cookie? How do they work? Why is possible to access them from multiple domains? Do I have to worry and if yes, how to mitigate their effect? Sources http://...
Gudradain's user avatar
  • 7,001
5 votes
1 answer
441 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
makerofthings7's user avatar
5 votes
1 answer
5k views

Is session/cookie based authentication stateful or stateless?

Flask Web Development says The current login functionality implemented with the help of Flask-Login stores data in the user session, which Flask stores by default in a client-side cookie, so the ...
Tim's user avatar
  • 657
5 votes
1 answer
3k views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
lucasvc's user avatar
  • 153
3 votes
1 answer
13k views

How to detect, inspect and delete a super cookie of a specific website? [closed]

Definition of supercookie from the paper I am reading: "Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local ...
sanjihan's user avatar
  • 639
3 votes
3 answers
1k views

Are flash cookies still a threat and that persistent?

One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
Gero's user avatar
  • 215
3 votes
1 answer
3k views

Doesn't Samesite cookie and Sameorigin policy effectively does the same job?

Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is ...
Jiger Jain's user avatar
3 votes
1 answer
6k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
SameOldNick's user avatar
2 votes
1 answer
734 views

What's the advantage in allowing 3rd party cookies?

I understand why people want to block 3rd party cookies - I would like to know though what would I be missing out from blocking them? Why do browsers like Chrome have them on by default? Is it simply ...
stickman's user avatar
  • 1,590
1 vote
3 answers
704 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
Maik Klein's user avatar
1 vote
1 answer
383 views

How to prevent security risk when logout failed for authentication cookies

In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected. But it seems that there ...
欧阳维杰's user avatar
1 vote
3 answers
16k views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
Graviton's user avatar
  • 925
0 votes
1 answer
1k views

should I not accept cookies for the sake of anonymity?

Let's say I had a Gmail account. Should I just not have a Gmail account, or should I not use their cookies? How bad are the cookies, in of themselves? I obviously wouldn't log into it, with my VPN or ...
user3695903's user avatar
0 votes
1 answer
3k views

localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?

If I were to implement a common OpenID Connection pattern on a SPA, I might have the following relationship: Auth server <-----------> Client (browser) <-----------> App API server The ...
M Miller's user avatar
  • 153
0 votes
1 answer
2k views

Import Wireshark Cookies into Firefox?

I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies. Greasemonkey and ...
user182487's user avatar
77 votes
3 answers
37k views

For SameSite cookie with subdomains what are considered the same site?

For the samesite cookie attribute I'm not clear on if I set a cookie with domain .example.com from sub.example.com with the samesite attribute, if it will be considered the same site as other.example....
derduher's user avatar
  • 873
63 votes
2 answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
bandybabboon's user avatar
46 votes
4 answers
100k views

Can a webpage read another page's cookies?

I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long ...
KnightOfNi's user avatar
  • 2,287
44 votes
3 answers
63k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
rdmueller's user avatar
  • 2,763
33 votes
6 answers
21k views

Can't a user change his session information to impersonate others?

Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user? Say for example, if a website uses the database ...
mzcoxfde's user avatar
  • 605