Hot answers tagged

121 votes

How does Facebook track your browsing without third party cookies?

Facebook does not need to use third-party cookies to track you as you move from site to site, if the sites contain Facebook's javascript code (e.g. for the Facebook 'like' button). In this case, ...
mti2935's user avatar
  • 23.4k
120 votes
Accepted

Do I need CSRF token if I'm using Bearer JWT?

This is relevant but doesn't necessarily answer 100% of your question: https://security.stackexchange.com/a/166798/149676 The short of it is that as long as authentication isn't automatic (typically ...
Conor Mancone's user avatar
119 votes
Accepted

Can "Accept cookie" button in a website be malicious?

Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user. Legally, that is another matter. In ...
A. Hersean's user avatar
  • 10.6k
108 votes
Accepted

Are EU cookie consent forms safe?

It increases dialog box fatigue. By overflowing the user with mundane dialog boxes, they are more likely to get into the habit of just clicking OK to remove the dialog box from their screen. This ...
Sjoerd's user avatar
  • 30.4k
97 votes
Accepted

Does a CSRF cookie need to be HttpOnly?

As joe says, there is no real security benefit to this. It is pure security theater. I'd like to highlight this from the documentation: If you enable this and need to send the value of the CSRF ...
Anders's user avatar
  • 65.6k
93 votes
Accepted

Can cookies carry viruses?

You can put any text strings into a cookie, so in theory you could put some kind of code there. But for code to do any harm something needs to run it. The web browser does not interpret the content of ...
Anders's user avatar
  • 65.6k
83 votes
Accepted

What are the risks of just clearing cookies instead of logging off?

Can I just log out by wiping cookies instead of hitting logout? Frequently yes, for the reasons you supplied in your question: Without the session token in your cookies, a typical web application won'...
Ghedipunk's user avatar
  • 6,050
79 votes

Can "Accept cookie" button in a website be malicious?

A malicious website could harm you without you having to click on anything. However, the fact that the user clicked on a page element simplifies the task: for example, most browsers would ...
Dmitry Grigoryev's user avatar
74 votes
Accepted

For SameSite cookie with subdomains what are considered the same site?

The 'Site' in SameSite refers to a the combination of second level domain mysite.com and top level domain mysite.com. This means that a requests from login.mysite.com to cdn.mysite.com would be ...
ilikebeets's user avatar
  • 2,876
60 votes
Accepted

Will same-site cookies be sufficient protection against CSRF and XSS?

First, a definition from Chrome: Same-site cookies (née "First-Party-Only" (née "First-Party")) allow servers to mitigate the risk of CSRF and information leakage attacks by ...
Anders's user avatar
  • 65.6k
60 votes
Accepted

Can advertisements read cookies of the website it is on?

Any script included into a page can read all cookies for which the httpOnly attribute is not set. Access restrictions for scripts are not determined based on the domain the script was loaded from but ...
Steffen Ullrich's user avatar
59 votes

Why isn't stealing cookies enough to authenticate?

Technically, even if the contents in the cookie were to be encrypted, if cookies are properly copied to the new browser and the new browser sends the same HTTP headers (same user agent string, ...
Wadih M.'s user avatar
  • 1,132
57 votes
Accepted

Can't a user change his session information to impersonate others?

Yes, if you can guess another user's session key then you can become them. This is why you need to have a unpredictable session key that can be revoked. There have been cases where best practice ...
Topher Brink's user avatar
  • 1,649
57 votes
Accepted

Can ISPs replace a website's HTML/JavaScript/HTTP headers with something else?

Your ISP is per definition a MITM (man-in-the-middle) and therefore can serve you any content it desires. You mentioned HTTPS and this is of course a game changer. Yes, the ISP can server any ...
Demento's user avatar
  • 7,465
48 votes

Do I need CSRF token if I'm using Bearer JWT?

Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that ...
ndrix's user avatar
  • 3,306
40 votes
Accepted

Is there any point in setting the secure cookie flag for HSTS websites?

Yes, you should still mark your cookies as secure, for three reasons: You dont want them to be exposed just because of a server configuration mishap. What if you move your application to a server ...
Anders's user avatar
  • 65.6k
35 votes
Accepted

How to tell if a webapp transmits my password in cleartext?

There are two reasons to ask if your password is being encrypted: You are worried about the security of the site. You are worried about the security of your password. Regarding site security, with ...
Neil Smithline's user avatar
35 votes
Accepted

The non-compliance of the EU cookie law as a finding in a penetration test report?

I don't know of any technical security impact relating to not adhering to EU cookie laws. Ultimately I think this is mostly down to the discretion of the assessor and the context of the assessment. ...
Polynomial's user avatar
  • 135k
34 votes
Accepted

Setting Same-Site cookie attribute to Lax

Is setting Same-Site attribute of a cookie to lax the same as not setting the Same-Site attribute? In Google Chrome < 76 – no. Setting SameSite=lax is safer than omitting the attribute. (But if ...
Arminius's user avatar
  • 44.7k
32 votes

Why isn't stealing cookies enough to authenticate?

The contents of a cookie are application-defined, and there are all sorts of ways to use them. Here is a short list of some of the possible reasons why your effort failed. The cookie is bound to the ...
John Wu's user avatar
  • 9,311
30 votes
Accepted

Is it safe to store a JWT in sessionStorage?

How bizarre! I asked basically the same question about a month ago. In the end, we decided that using localstorage for the JWT token was ok, as long as we also did the following on the HTTP level: ...
JMK's user avatar
  • 2,496
30 votes
Accepted

Workarounds for sites that are broken without cookies?

If you're concerned about trackers, you're probably looking for First Party Isolation. First Party Isolation is a feature that Firefox adopted from the Tor browser's Cross-Origin Identifier ...
Arminius's user avatar
  • 44.7k
29 votes
Accepted

Stealing Facebook HTTPS cookies with captive portal

If you visit HTTPS sites and get redirected without any warnings then the problem is that your browser doesn't correctly validate certificates - a good browser would display a warning as the captive ...
André Borie's user avatar
  • 12.8k
29 votes
Accepted

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. You must have misinterpreted something. In fact HTTP sessions are usually implemented using cookies. I'm thinking that if I could get &...
Steffen Ullrich's user avatar
28 votes

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

Secure cookies can be set over insecure channels (e.g. HTTP) as per section 4.1.2.5 of RFC 6265. It explicitly mentions that the Secure flag only provides confidentiality and not integrity, as a ...
Polynomial's user avatar
  • 135k
27 votes

Can't a user change his session information to impersonate others?

Yes. It can. Session information is stored in server side (except the session token) while cookies in the other way are stored in the client side (browser). So the attacker might change the session ...
Vini7's user avatar
  • 659
27 votes
Accepted

Is a secure cookie without the HttpOnly flag a problem?

The secure flag ensures that the setting and transmitting of a cookie is only done in a secure manner (i.e. https). If there is an option for http, secure flag should prevent transmission of that ...
Link's user avatar
  • 496
26 votes

How to confirm that an embedded iframe can read cookies from parent?

First thing to note is that iframes (by default) don't act like they're part of the same origin, unless they are. If the iframe origin (in the src attribute) and the parent origin differ, the iframe ...
CBHacking's user avatar
  • 47.6k
26 votes

How does Facebook track your browsing without third party cookies?

In addition to the other answers: The website you visited could have sent information about your visit directly to Facebook using their "Server-side API". This doesn't need any client-side ...
Aaron F's user avatar
  • 361

Only top scored, non community-wiki answers of a minimum length are eligible