2
votes
1answer
249 views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
10
votes
5answers
980 views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
1
vote
3answers
3k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
-1
votes
1answer
255 views

how to secure my login user id and passwords specially for facebook [closed]

i think they hack me with facebook cookies. i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...
2
votes
1answer
336 views

How does IE's Privacy options affect javascript's ability to save cookies?

I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience. Is there a guide that ...
3
votes
5answers
356 views

Is it possible to see if a script on a website steals session cookies?

I'm looking as some web analytics solutions, I know it sounds paranoid. but cookie-based web analytics need for you to paste their JavaScript code on your web-site. I don't like the idea too much of ...
5
votes
1answer
320 views

Using javascript, is it possible to iterate through all cookies saved in the user browser and send them to me?

Again, I am new to the programming and security world. I should mention that it is just a theoretical question so I can anticipate this kind of attack. Using javascript, is it possible to iterate ...
5
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...