Questions tagged [cookies]

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

Filter by
Sorted by
Tagged with
7
votes
2answers
1k views

What happens if my anti-CSRF token is compromised by an XSS attack?

The interesting Stack Overflow question "Do cookies protect tokens against XSS attacks?" was closed as too broad, but as mentioned in a comment on it, there is a tangible question of "What happens if ...
5
votes
2answers
2k views

Is CSRF possible in an SSR SPA with cookie authentication?

I have a Single-Page Application, which is basically a consumer to my API which authenticates using the Authorization header. Now because I do server-side-rendering, I need to authenticate on the ...
40
votes
2answers
7k views

Can advertisements read cookies of the website it is on?

I know many ads can store third-party cookies, but what about reading cookies? If so, what stops them from reading the session id to perform session hijacking?
18
votes
1answer
3k views

How does Firefox's “first-party isolation” feature function?

First-party isolation (privacy.firstparty.isolate in about:config, set to false by default) originated from the Tor browser and was recently added to Firefox. Unfortunately I haven't found enough ...
0
votes
2answers
1k views

Knowing a web application is HTTPS only, do HTTP cookie need the secure flag?

My understanding of secure flag on HTTP cookies is: it will prevent the client from sending cookie in an HTTP connection, preventing a MITM attacker from grabbing the cookie details. What if a Web ...
59
votes
7answers
23k views

Does a CSRF cookie need to be HttpOnly?

We recently were handed a security report containing the: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix was as ...
5
votes
2answers
314 views

Is a user being able to view their own UID a security risk?

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first. ...
3
votes
1answer
1k views

Are HTTPonly cookies secure enough for implementing “remember me” functionality?

I have a website which have a "remember me" functionality. When someone clicks that functionality it sets the user password and username in a cookie to remember him/her. Okay, fine. But, that cookie ...
0
votes
1answer
2k views

localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?

If I were to implement a common OpenID Connection pattern on a SPA, I might have the following relationship: Auth server <-----------> Client (browser) <-----------> App API server The ...
6
votes
2answers
5k views

Better security - Session ID in cookies vs. Encrypted cookie

Debating these two methods of storing session data: https://github.com/mozilla/node-client-sessions (Store all session data in the cookie and encrypt it) https://github.com/expressjs/session (Session ...
0
votes
2answers
849 views

JWT authentication or cookies?

I am currently creating a login system for my website. To secure the login service, should I use JSON Web Tokens and HTML5 storage, or should I use use the older way of using cookies? Are any of ...
4
votes
3answers
3k views

Are HttpOnly or Secure flags needed if no login?

My question is really simple, are HttpOnly or Secure flags needed if a website doesn't have a private part accessible with login?
1
vote
2answers
665 views

Being anonymous on the Internet [closed]

I change my IP, and then I want to access a website with a new identity I also need to delete the cookies. Would that be enough? Are there any other ways to store information and get it back with the ...
0
votes
1answer
367 views

Opening browser with already authenticated user in other app

Scenario: I'm logged in some (java - swing) application. The authentication is typical: login and password checked by server (J2EE) on client application start, after that normal work in app including ...
0
votes
1answer
437 views

Preventing CSRF with implicit flow and JWTs?

I'm reading through openid connect document ATM and it says: Put into a browser cookie the ID token can be used to implement lightweight stateless sessions. IIUC we want to avoid using cookies in ...
1
vote
2answers
576 views

Bypass the “double submit cookie” protection?

Is it possible for an attacker to spoof the double submit token/cookie, when the first token/cookie is in the Cookie header and the 2nd token/cookie is in the body params. Yeah, there is a way using ...
1
vote
0answers
302 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
5
votes
0answers
169 views

How to encrypt cookies in Xamarin?

I have a Xamarin application which creates a few files in /data/data/my.app.com/app_webview after using it. The problem is that the cookies file is a file which contains session cookies. According ...
4
votes
2answers
3k views

Secure flag for ASPXAUTH Cookie in MVC

We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool. Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's ...
2
votes
1answer
697 views

Double Submit Cookie Implementation questions

I have read up on the Double Submit Cookies vulnerabilities question and while it answers a bunch of questions I am still a bit confused. I have taken a look at this repo: https://github.com/jeongl/...
0
votes
2answers
95 views

Is this method of managing storageless session management secure?

I have a web application in which users can log in. Due to technical constraints, the application is not allowed to store any session information on the disk. To identify requests from the same user ...
1
vote
1answer
656 views

Is it secure to reuse CSRF token from existing cookie (for a new tab in browser)?

We have a system that does async request to backend to get CSRF (via AJAX). The response from the server is a new cookie and a header that we remember in javascript and use later. It all works fine ...
3
votes
1answer
11k views

Secure flag not set to Cookies in .Net MVC application

I have included the below lines of codes in my Web.Config and Glbal.asax.cs files, but still when I use developer tools in the browser I the secure flags were not set for the below cookies. Also ...
0
votes
1answer
77 views

What are requirements for a cookie authenticating an user?

At my company we can't use session to keep users logged because the website is splitted between node and PHP backends. We thought of generating the user a token after he logs in and store both this ...
58
votes
4answers
42k views

Do I need CSRF token if I'm using Bearer JWT?

Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
-1
votes
4answers
8k views

Where should I store user_id for authentication: in cookie or session?

I've decided to implement a simple, custom authentication system on my own for my web application: when a user logs in, I'll store their "user_id" in either a session or cookie. If I choose cookie, ...
12
votes
3answers
5k views

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. For example, if a web uses a cookie to detect if an user has logged in or not, people can forge a cookie to simulate a false user because he ...
-2
votes
1answer
70 views

Will these kind of cookies cause security threat?

My PHPSESSID is encrypted it says encrypted connections only. But while viewing cookie from bowser it shows other 2-3data like in below picture (and similar to this picture there are few more) and ...
1
vote
1answer
3k views

Cookie vs HTML5 localStorage

On HTML5, we can use localStorage to keep data persistently on client side. It seems better from a non-security point of view (easy to access, not 5mb limit like cookies, etc). https://www.w3schools....
2
votes
0answers
835 views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
27
votes
3answers
16k views

Setting Same-Site cookie attribute to Lax

Is setting Same-Site attribute of a cookie to Lax the same as not setting it at all? If there are differences what are they?
1
vote
1answer
985 views

CSRF Protection for JSON API with Cookie Auth [duplicate]

I am building the API for a SPA and Chrome plugin using Rails, and I am inclined to go use Secure HTTPOnly cookies for authentication because: This is the default solution for standard Rails auth ...
3
votes
1answer
106 views

Is this a valid secure cookie scheme?

I have a scheme for a cookie with high-level confidentiality of information. The information to be hidden from the client is the expiration time of the cookie. I am wondering what insecurities i am ...
0
votes
1answer
151 views

Device Identification for 2FA challenge

Most sites that take security seriously, try to identify the moment when you use a new (or "unfamiliar") device to sign in to your online account. Example, when you sign in from a different computer ...
0
votes
1answer
466 views

WordPress 4.7.2 Authentication Cookie Brute-force

I recently came across a WordPress (v 4.7.2) site with an exposed wp-config.php file, within which plain text server authorisation key secrets were accessible. Having read Mike Czumak's article on ...
4
votes
1answer
2k views

non secure connection in youtube

I was browsing a while ago on youtube, I saw it shows an insecure connection even though it was over https. I'm using ghostery and adblock to block trackers but nothing more, I don't think it's the ...
4
votes
6answers
5k views

Stop YouTube tracking when signed out

I use YouTube while signed out. I have a Google account, but I only sign in to check email, then sign right back out. YouTube is tracking what I watch when signed out, then putting similar videos in ...
8
votes
3answers
2k views

Are encrypted Cookies vulnerable to Padding Oracle Attacks

I'm currently helping write a fast compiled web framework in the crystal language and am trying to find a way to speed up sessions using encrypted cookies. We're currently taking a json string and ...
0
votes
0answers
515 views

Cookie issue on same server with different domain

I am using Zend framework 2 for my two applications (xyz.com and pqr.com) on the same server. I have a problem with cookie, when I logged in into xyz.com and edit the browser cookie settings using ...
1
vote
3answers
3k views

Could someone steal all stored cookies with an XSS attack?

I mean, with "document.cookies" the browser shows cookie(s) that belong(s) to only for that website. (Or doesn't it?) So, could an XSS attack steal all stored cookies in device/browser? Thanks.
1
vote
1answer
255 views

How are Google always identifying me? [closed]

I'm trying to create multiple Google accounts Here's my setup: I use Firefox with the FoxyProxy plugin and a bunch of IP's. I use the Firefox Random Agent Spoofer plugin, with the following ...
4
votes
1answer
469 views

Combining HTTP smuggling & Trace HTTP method

Context While studying HTTP smuggling attack patterns, i found this nice article wrote by Regilero There is one point that i want to clarify on the credential hijacking pattern. I was more or less ...
2
votes
3answers
364 views

What's stopping people from modifying cookies to change who they're logged in as?

I'm developing a social network and to my knowledge, the best way of storing between pages which user is logged on is using cookies. So, suppose I'm storing a cookie of the user ID which is logged in. ...
4
votes
2answers
5k views

Why don't browsers restrict cookies per-tab to combat CSRF attacks?

Why are the cookies shared between browser tabs? does avoiding this prevent CSRF on cookie based authentication web sites? Is sharing the cookie between tabs favored for easily accessing the website ...
3
votes
1answer
1k views

How do cookies work together with token binding?

Token binding is a mechanism where the client sends an signed token to the server. Because this token is based on a private key it is harder to steal than session cookies. What I don't understand is ...
2
votes
1answer
853 views

Cross-domain tracking techniques

I have read several articles about user tracking through web trackers (e.g. doubleclick) across domains. Many articles write about cookies, web storage, flash cookies, ETags or image caching ...
2
votes
3answers
2k views

Tracking Cookie Security Risks?

Today I sat the 2017 Higher Computing exam paper. One of the questions was to name a security risk of tracking cookies. One mark. I just rambled a little about targeted advertising and monitoring ...
1
vote
3answers
128 views

How to stop search engines from saving your history?

I'm using firefox - I've disabled any cookies (Accept cookies from sites is not ticked and the Show cookies page is empty) but no-matter what search engine I use - my clicked pages are saved! How is ...
6
votes
1answer
1k views

Strict secure cookies vs. cookie prefixes

The secure flag on cookies prevent them from being read by an insecure (non-HTTPS) site, but they can still be written or deleted from an insecure site. There are two new browser features that try to ...
11
votes
2answers
5k views

Facebook's warning of self-xss

I happened to open my browser console on Facebook recently and was greeted with the following message. Stop! This is a browser feature intended for developers. If someone told you to copy and ...

1
3 4
5
6 7
14