121
votes
How does Facebook track your browsing without third party cookies?
Facebook does not need to use third-party cookies to track you as you move from site to site, if the sites contain Facebook's javascript code (e.g. for the Facebook 'like' button). In this case, ...
- 22.7k
119
votes
Accepted
Can "Accept cookie" button in a website be malicious?
Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user.
Legally, that is another matter. In ...
- 10.5k
117
votes
Accepted
Do I need CSRF token if I'm using Bearer JWT?
This is relevant but doesn't necessarily answer 100% of your question:
https://security.stackexchange.com/a/166798/149676
The short of it is that as long as authentication isn't automatic (typically ...
- 30.9k
108
votes
Accepted
Are EU cookie consent forms safe?
It increases dialog box fatigue. By overflowing the user with mundane dialog boxes, they are more likely to get into the habit of just clicking OK to remove the dialog box from their screen. This ...
- 29.6k
97
votes
Accepted
Does a CSRF cookie need to be HttpOnly?
As joe says, there is no real security benefit to this. It is pure security theater. I'd like to highlight this from the documentation:
If you enable this and need to send the value of the CSRF ...
- 65.4k
93
votes
Accepted
Can cookies carry viruses?
You can put any text strings into a cookie, so in theory you could put some kind of code there. But for code to do any harm something needs to run it. The web browser does not interpret the content of ...
- 65.4k
83
votes
Accepted
What are the risks of just clearing cookies instead of logging off?
Can I just log out by wiping cookies instead of hitting logout?
Frequently yes, for the reasons you supplied in your question: Without the session token in your cookies, a typical web application won'...
- 6,030
79
votes
Can "Accept cookie" button in a website be malicious?
A malicious website could harm you without you having to click on anything. However, the fact that the user clicked on a page element simplifies the task: for example, most browsers would ...
- 10.2k
70
votes
Accepted
For SameSite cookie with subdomains what are considered the same site?
The 'Site' in SameSite refers to a the combination of second level domain mysite.com and top level domain mysite.com.
This means that a requests from login.mysite.com to cdn.mysite.com
would be ...
- 2,836
60
votes
Accepted
Can advertisements read cookies of the website it is on?
Any script included into a page can read all cookies for which the httpOnly attribute is not set. Access restrictions for scripts are not determined based on the domain the script was loaded from but ...
- 198k
59
votes
Accepted
Will same-site cookies be sufficient protection against CSRF and XSS?
First, a definition from Chrome:
Same-site cookies (née "First-Party-Only" (née "First-Party")) allow servers to mitigate the risk of CSRF and information leakage attacks by ...
- 65.4k
59
votes
Why isn't stealing cookies enough to authenticate?
Technically, even if the contents in the cookie were to be encrypted, if cookies are properly copied to the new browser and the new browser sends the same HTTP headers (same user agent string, ...
- 1,132
57
votes
Accepted
Can't a user change his session information to impersonate others?
Yes, if you can guess another user's session key then you can become them. This is why you need to have a unpredictable session key that can be revoked.
There have been cases where best practice ...
- 1,649
57
votes
Accepted
Can ISPs replace a website's HTML/JavaScript/HTTP headers with something else?
Your ISP is per definition a MITM (man-in-the-middle) and therefore can serve you any content it desires.
You mentioned HTTPS and this is of course a game changer. Yes, the ISP can server any ...
- 7,419
46
votes
Do I need CSRF token if I'm using Bearer JWT?
Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that ...
- 3,286
40
votes
Accepted
Is there any point in setting the secure cookie flag for HSTS websites?
Yes, you should still mark your cookies as secure, for three reasons:
You dont want them to be exposed just because of a server configuration mishap. What if you move your application to a server ...
- 65.4k
35
votes
Accepted
How to tell if a webapp transmits my password in cleartext?
There are two reasons to ask if your password is being encrypted:
You are worried about the security of the site.
You are worried about the security of your password.
Regarding site security, with ...
- 14.8k
35
votes
Accepted
The non-compliance of the EU cookie law as a finding in a penetration test report?
I don't know of any technical security impact relating to not adhering to EU cookie laws.
Ultimately I think this is mostly down to the discretion of the assessor and the context of the assessment. ...
- 135k
34
votes
Accepted
Setting Same-Site cookie attribute to Lax
Is setting Same-Site attribute of a cookie to lax the same as not setting the Same-Site attribute?
In Google Chrome < 76 – no. Setting SameSite=lax is safer than omitting the attribute. (But if ...
- 44.6k
32
votes
Why isn't stealing cookies enough to authenticate?
The contents of a cookie are application-defined, and there are all sorts of ways to use them. Here is a short list of some of the possible reasons why your effort failed.
The cookie is bound to the ...
- 9,281
30
votes
Accepted
Is it safe to store a JWT in sessionStorage?
How bizarre! I asked basically the same question about a month ago.
In the end, we decided that using localstorage for the JWT token was ok, as long as we also did the following on the HTTP level:
...
- 2,496
30
votes
Accepted
Workarounds for sites that are broken without cookies?
If you're concerned about trackers, you're probably looking for First Party Isolation.
First Party Isolation is a feature that Firefox adopted from the Tor browser's Cross-Origin Identifier ...
- 44.6k
29
votes
Accepted
Stealing Facebook HTTPS cookies with captive portal
If you visit HTTPS sites and get redirected without any warnings then the problem is that your browser doesn't correctly validate certificates - a good browser would display a warning as the captive ...
- 12.8k
29
votes
Accepted
Why doesn't Tornado have session
I've heard that cookies is less secure than the session.
You must have misinterpreted something. In fact HTTP sessions are usually implemented using cookies.
I'm thinking that if I could get &...
- 198k
28
votes
Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?
Secure cookies can be set over insecure channels (e.g. HTTP) as per section 4.1.2.5 of RFC 6265. It explicitly mentions that the Secure flag only provides confidentiality and not integrity, as a ...
- 135k
27
votes
Can't a user change his session information to impersonate others?
Yes. It can.
Session information is stored in server side (except the session token) while cookies in the other way are stored in the client side (browser). So the attacker might change the session ...
- 659
27
votes
Accepted
Is a secure cookie without the HttpOnly flag a problem?
The secure flag ensures that the setting and transmitting of a cookie is only done in a secure manner (i.e. https). If there is an option for http, secure flag should prevent transmission of that ...
- 496
26
votes
How to confirm that an embedded iframe can read cookies from parent?
First thing to note is that iframes (by default) don't act like they're part of the same origin, unless they are. If the iframe origin (in the src attribute) and the parent origin differ, the iframe ...
- 46.2k
26
votes
How does Facebook track your browsing without third party cookies?
In addition to the other answers:
The website you visited could have sent information about your visit directly to Facebook using their "Server-side API".
This doesn't need any client-side ...
- 361
Only top scored, non community-wiki answers of a minimum length are eligible