Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 102236

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data on the user's computer.

4
votes
the client side. This second cookie is not HttpOnly, so you can remove it using JavaScript. To perform authenticated requests you need both cookies, and an XSS attack can't read the session cookie …
answered Aug 7 by Sjoerd
4
votes
This is less secure than the normal way to set cookies because you can't set the HttpOnly flag on your cookies. This means that the cookies can be read by Javascript, and this is particularly a … problem if the website has an XSS vulnerability. In that case, the attacker can directly read your cookies and take over your session. …
answered May 9 '16 by Sjoerd
0
votes
from altering cookies is by cryptographically signing them. In the cookie value you include both the actual value and a hash of the value and some secret key. Only people who have the secret key can then … change cookies. This is tricky to implement securely by yourself, so it would be best if this functionality is supported by the framework you are using. …
answered Feb 23 '17 by Sjoerd
2
votes
It is possible to store information in cookies and prevent users from tampetering with the data in the cookies. The way to do this is to create a HMAC of the cookie value and store that along with … created by the server. Some frameworks have this built in (expressjs, rails). This question discusses the concept of signed cookies some more. …
answered Jun 8 '17 by Sjoerd
2
votes
In the application. The cookies themselves are set by the application, and the cookie flags are part of that. Cookies can have several flags: "secure", "httponly", "samesite". Only the application … knows which cookies should have which flags. If your proxy inserts the httponly flag and the application wants to access the cookie with Javascript, this will no longer work. Cookies are the …
answered Nov 20 '16 by Sjoerd
2
votes
A session has presence both on the client and on the server: On the client, the session identifier is stored in a cookie with a limited lifespan. On the server, the session is stored somewhere and t …
answered Dec 19 '18 by Sjoerd
3
votes
The strict secure cookies draft describes a limitation of strict secure cookies where cookie prefixes can help: The mitigations in this document do not, however, give complete confidence … mount an attack against "example.com", even if that site uses HTTPS exclusively. If there is no cookie yet, an insecure origin can set a secure cookie, but not a prefixed cookie. So cookie prefixes are still a good idea when using browsers that implement strict secure cookies. …
answered May 29 '17 by Sjoerd
1
vote
Use the SameSite flag to prevent CSRF attacks. Use cookie prefixes to prevent cookie clobbering. Use a HMAC to prevent cookie tampering. You say you have prevented this using a salt. It is unclear wh …
answered May 1 '17 by Sjoerd
1
vote
A session is data stored on the server corresponding to some client. To know which data to access, the client gets a cookie with a session identifier. The value of this identifier is not meaningful, i …
answered Jan 2 '17 by Sjoerd
0
votes
What if a Web application is running only on HTTPS? If the client exclusively connects to the server using HTTPS, the secure flag has no effect. Note that this is independent of what the server d …
answered Dec 18 '17 by Sjoerd
1
vote
Is it possible for cookies to be used for user tracking and targeted advertising? Yes. If a page contains a "Share on Facebook" button it is often loaded from Facebook. A little piece of … JavaScript and the image for the button are requested from facebook.com. Your current cookies are sent along in the request. Facebook now knows which page you visited and uses this for targeted advertising …
answered Aug 30 '18 by Sjoerd
1
vote
why you are not storing the CSRF token into a session variable of the logged in user and display it on a page in a hidden field This is a proper and commonly used solution to prevent CSRF. Store …
answered Feb 20 by Sjoerd
2
votes
Is it possible to steal cookies through MITM on 'HTTPS' site if the cookies are missing 'Secure' Flag? If the client does a HTTP request, the browser sends the cookies over plaintext HTTP to the … src="http://yourbank.com/"> which will cause a plaintext request to yourbank.com, with the cookies. Strict Transport Security (HSTS) protects against this, because it forces the connection to be over …
answered Jun 22 '18 by Sjoerd
2
votes
You have a typo in your header: header = '{"alg":"none"","typ":"JWT"}' none has two quotes at the end.
answered Oct 14 by Sjoerd
107
votes
It increases dialog box fatigue. By overflowing the user with mundane dialog boxes, they are more likely to get into the habit of just clicking OK to remove the dialog box from their screen. This incr …
answered Sep 3 '18 by Sjoerd

15 30 50 per page