Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

92 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
564 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now use ...
5
votes
0answers
193 views

How to encrypt cookies in Xamarin?

I have a Xamarin application which creates a few files in /data/data/my.app.com/app_webview after using it. The problem is that the cookies file is a file which contains session cookies. According ...
4
votes
0answers
426 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, ...?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
4
votes
0answers
127 views

Is there any risk if my Google Analytics cookies can be seen by an attacker?

In particular, I'm concerned about a scenario where I'm using GA cookies on a subdomain, e.g. alice.example.com, and the cookies are marked as .example.com, which means that a site on eve.example.com ...
4
votes
1answer
10k views

Why did Chrome show my connection to Youtube as not secure?

I was browsing on Youtube a while ago, when I noticed that Chrome showed it as an insecure connection even though it was over HTTPS. I'm using Ghostery and Adblock to block trackers but nothing more, ...
3
votes
0answers
264 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
3
votes
0answers
259 views

How to set Secure attribute to csfcfc cookie in Glassfish?

After a vulnerabilities scan, I found that the csfcfc cookie does not have the Secure attribute. JSESSIONID has httpOnly and Secure attributes. Is there a way to force it? I found an answer for JBoss ...
3
votes
0answers
1k views

In practice, are 3rd party cookies used in Authentication? If they are blocked, what is the UX?

I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings. It's clear that CORS and ...
3
votes
0answers
252 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
3
votes
1answer
298 views

Separate third-party cookies for each website

Instead of blocking third-party cookies (which might be useful), why don't browsers allow them, but keep all cookies separate for each address-bar website? For example, if a third-party website sets ...
2
votes
0answers
154 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
2
votes
1answer
754 views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
2
votes
0answers
210 views

What's the point of salting Double Submit Cookie (CSRF protection)?

Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
2
votes
0answers
88 views

Possible cookie attack

I am testing an web application and I found a cookie in which the language of the application is set. Specifically, I have modified one request and I have noticed that all the other requests it makes ...
2
votes
0answers
203 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
2
votes
0answers
714 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
2
votes
0answers
429 views

Alternative to sensitive data in cookie

My company has a travel app which helps you buy tickets for work related travels. When you need to travel you enter your details on SAP and it it sent to your manager for approval. When it is approved,...
2
votes
0answers
1k views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
2
votes
0answers
119 views

If I clear my browsing data, is HSTS protection removed?

I've seen that if I delete cookies and other data on Google Chrome, SSLStrip+ works successfully on those web sites that are not included in the browser list. Is it because HSTS data is cleared too?
2
votes
0answers
479 views

Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?

I won't really go into details of how cookie tossing and cookie overflow attacks work, because this answer explains it perfectly. This post on github explains some mitigation strategies, but does not ...
2
votes
2answers
1k views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
2
votes
1answer
141 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
1
vote
1answer
115 views

What's arstechnica.com messing with my Firefox cookies?

I decided to post on Security as it's more a privacy-oriented question. I could post it on Superuser as a browser question. These days I am experiencing a strange behaviour with Firefox 92.0.1 ...
1
vote
2answers
288 views

Is it possible to set an HttpOnly Cookie from one domain to another subdomain

I am pretty sure that the answer to my question is no, but I have been have a hard time finding an answer through official documentation or other posts here. Here is simple use case for some context: ...
1
vote
0answers
85 views

Is a static SameSite cookie enough to protect against CSRF?

Conventional wisdom to prevent CSRF is to use CSRF tokens, but with the new cookie attributes and prefixes, do you even need to generate/save tokens at all? I've had the thought that if I just set a ...
1
vote
0answers
69 views

Facebook retargeting pixel

Given a commercial website buy.com and a user with a Facebook account in facebook.com, the user has third-party cookies disabled in the browser. If a user is logged in their Facebook account and ...
1
vote
0answers
133 views

httpOnly Cookie Security Flaw

I'm bit confused about this security flaw. I'm in real need of help in this :smile: My express code (not using any sessions, just cookie-parser) app.get("/signin", (req, res) => { if(!...
1
vote
0answers
95 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
1
vote
1answer
352 views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...
1
vote
0answers
140 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
1
vote
0answers
135 views

performing authenticated scan for xss using selenium and xsstrike tool

I'm automating XSS security test, I automated XSS reflected and stored, now for automating XSS dom I'm required to use XSSStrike tool (https://github.com/s0md3v/XSStrike/wiki/Usage). Im using ...
1
vote
0answers
71 views

Have ad platforms started surveilling and sharing emails and PII?

I was on a webmastering forum and saw an ad that made a disturbing promise. They claimed that if a person makes a casual visit to your web site, they can obtain that person's email address, and ...
1
vote
1answer
104 views

Validating JWT in server-to-auth-server scenario

The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario? I am looking ...
1
vote
0answers
3k views

Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution

I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
1
vote
0answers
125 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
1
vote
0answers
254 views

Does copying cookies from one pc to other makes Gmail believe that the other device is not a new device login?

Each time I login into a new device either Gmail or Facebook login, it send a notification to my mobile saying a login is detected in a new device stating the device name or OS name. I am curious to ...
1
vote
2answers
1k views

Would cookie always change when browser changes?

I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it'...
1
vote
3answers
658 views

How can the Cookie-to-header-token CSRF protection technique be thwarted by permissive CORS origin header?

According to https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token The protection provided by this technique can be thwarted if the target website disables its same-...
1
vote
0answers
728 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
1
vote
0answers
120 views

Parent domain cookies for Single Sign on

Typically Single Sign On is implemented with existing protocols like SAML or OAuth. If all the sites belongs to the same parent domain such as a.example.com and b.example.com, we can also set a ...
1
vote
0answers
62 views

Security concerns in cookie exporting between browsers

I'm wondering why Facebook is not handling the cookie export between browsers and related security concerns. This will be worst when they are using the "remember me" option as the cookies will be ...
1
vote
0answers
138 views

Protecting an api-token with cookie authentication only

I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over ...
1
vote
0answers
392 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
1
vote
0answers
374 views

Can a CSRF token be used as a session identifier instead of a cookie?

Someone has asked the same question here: Should CSRF token without session cookie work? but the people answering seem uncertain. So, why does anyone need a cookie at all if they are using a token ...
1
vote
0answers
453 views

Same value of WSS_KeepSessionAuthenticated cookie for different users after login

There is an application that uses NTLM authentication. After you enter your credentials, you get three cookies. I logged in with three different browsers(IE, chrome and mozilla) and as three different ...
1
vote
0answers
170 views

Accessing Chrome and Gmail on a stolen drive

I was trying to search for this, but could not find the answer anywhere - apology in advance if already answered. I have a Linux desktop installed on a thumb drive, which I keep in my pocket. This ...
1
vote
0answers
373 views

Can one scan multiple websites for tracking cookies and beacons?

Are there any tools or techniques that allow a scan of multiple sites for the use of tracking cookies, beacons, web bugs, or offsite javascript includes? As far as I can tell, major web application ...
1
vote
0answers
830 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
3k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
0
votes
0answers
36 views

E-commerce site auto-fills password

A popular e-commerce site displays its login page with your password auto-filled. I've double and triple checked that remembering passwords is disabled in my browsers. I've identified the cookie that ...