2022 Developer Survey is open! Take survey.

New answers tagged

1 vote

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

A correctly generated v4 UUID is always cryptographically random, that's in the spec. Verifying this, short of looking at the source code, is difficult. There are tests you can run (e.g. Burp Suite's &...
user avatar
  • 38.7k
2 votes
Accepted

Session cookie security

The cookie is sent in the header, so it is visible for eaves droppers. It is not visible for eavesdroppers on the network if the connection is encrypted, i.e. HTTPS is used. With HTTPS not only the ...
user avatar
3 votes
Accepted

Create a cryptographically secure random string for auth cookie in javascript

Is this safe enough or am I making a horrible mistake? Safe enough. Overkill, honestly. The most notable improvement I'd recommend here in particular is hashing the session token before storing it in ...
user avatar
  • 38.7k
1 vote

Create a cryptographically secure random string for auth cookie in javascript

Here is a simple html web page that uses the javascript Crypto.getRandomValues() function to create a random 32-byte hexadecimal string: <html lang="en"> <head> <meta charset=&...
user avatar
  • 19.6k

Top 50 recent answers are included