New answers tagged cookies
1
vote
I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?
A correctly generated v4 UUID is always cryptographically random, that's in the spec. Verifying this, short of looking at the source code, is difficult. There are tests you can run (e.g. Burp Suite's &...
- 38.7k
2
votes
Accepted
Session cookie security
The cookie is sent in the header, so it is visible for eaves droppers.
It is not visible for eavesdroppers on the network if the connection is encrypted, i.e. HTTPS is used. With HTTPS not only the ...
- 181k
3
votes
Accepted
Create a cryptographically secure random string for auth cookie in javascript
Is this safe enough or am I making a horrible mistake?
Safe enough. Overkill, honestly. The most notable improvement I'd recommend here in particular is hashing the session token before storing it in ...
- 38.7k
1
vote
Create a cryptographically secure random string for auth cookie in javascript
Here is a simple html web page that uses the javascript Crypto.getRandomValues() function to create a random 32-byte hexadecimal string:
<html lang="en">
<head>
<meta charset=&...
- 19.6k
Top 50 recent answers are included