Questions tagged [cookies]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
57 views

How to keep user logged in when using OpenID Connect & Cookies in dotnet core?

I'm working on an OpenID Connect Hybrid flow, basically the response type in my case is: code id_token Problem: I can't seem to persist the session of the user when logged in using the id_token. I ...
3
votes
4answers
242 views

Is a cookie hash that matches with file hash safe?

I've made a simple login form. It's made very generic to be used for any project. Now I wonder if the security is good enough and if my approach is safe. On success When successfully logged in I do ...
-1
votes
1answer
59 views

Do I need any sort of gdpr/cookie/localstorage notification if I only save data when the user creates an account?

I've made a website which is going into production soon. The website doesn't store any information about the user unless they create an account, in which case I save username, email and a password to ...
1
vote
1answer
862 views

Storing an id of a shopping cart in a cookie for unauthenticated user

I want to implement the "shopping cart" feature on my website. Both anonymous/unauthenticated and authenticated can have it. While it's clear how to implement it for an authenticated user, it's not ...
4
votes
2answers
315 views

Isn't it unsafe that any program can access cookies of a browser?

For example, for Firefox the cookies are kept as an SQLite DB in user's folder. Any program can read these cookies. So, for example, can't an .exe program read the contents of a cookie and pretend to ...
9
votes
2answers
10k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
1
vote
1answer
169 views

Should I encrypt my cookies using AES?

I'm going to encrypt the following data (server side): email, IP, username { *IP*: { email: *email at this IP* username: *username of email IP* } *IP2*: { email: ...
17
votes
2answers
5k views

Why can't sockets be used to identify individuals instead of cookies?

Another question was asked regarding the use of IP addresses to identify individual clients. I think I understand why an IP address is insufficient. But what about the socket, which has more ...
8
votes
3answers
358 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
4
votes
3answers
941 views

Saving Passwords for autologin

I know I should encrypt the password whenever I save passwords for security. But I don't know how should I encrypt password that when I save for autologin. If the password was just for checking user,...
0
votes
1answer
127 views

Create a browser cookie via executable on client machine

We have a web application that is accessed via kiosk workstations. We are looking for a way to track usage of each individual kiosk. Using the IP address was our first thought, but we quickly realized ...
1
vote
1answer
294 views

Should I use IP Address or Cookies for a simple rating plugin for my blog?

Basically, I have a blog where I want to add a rating system, which will allow users to rate each post on a scale from 1 to 5. I do not want the users to sign in, as that is too much hassle from my ...
-1
votes
1answer
3k views

Make browser allow secure cookie over http

Normally, browsers should not send cookies that have Secure option if connection is unsecured (i.e. http instead of https). Is there a configuration option or a plugin that would allow to change this ...
1
vote
1answer
1k views

Make PHP sessions truly last until the browser closes, and regenerating session on page requests

We have an issue where sessions are ending after a short time, 1440 seconds according to gc_maxlifetime settings which seems consistent with the issue. The PHPSESSID says it will expire when the ...
2
votes
1answer
872 views

Set authenticated users session cookie's to long term, but others to short term?

We want to extend the session duration for our users. I guess it doesn't matter for users who are not authenticated. We can create a PHPSESSID cookie for them and if it expires when they close their ...
2
votes
1answer
431 views

Is it acceptable for user agents to modify cookies other than by instruction from the server?

Using javascript or in a native iOS App it is possible to read and modify cookies. The server generally sets these, but if both the server and the client modifies the values then it becomes a global ...
1
vote
0answers
78 views

Alternatives to setting up an API system

I want to launch a service that could support integration by third-parties. Unfortunately it’s way out of hand to build an entire API by now. Here’s my question: Would there be any possible solution ...
1
vote
0answers
81 views

How to detect previous version cookies, and remove them?

We occasionally deploy our SSO system with some major changes. As much as we try to minimize it, on occasion we have require our users to delete all their "old" cookies. This is because their cookies ...
2
votes
1answer
506 views

Cross application cookie access

It was my understanding that cookies are transferred with each subsequent http request, yet if I log in to a web application that uses cookie authentication, say on my browser, other applications on ...
-1
votes
1answer
178 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
1
vote
2answers
731 views

Making a safe PHP login system [duplicate]

I am making a php website that requires user login. It has a remember me function. I would like to ask if the following approach is safe ? User logs in with correct username and pass (and remember me ...
4
votes
2answers
4k views

Is setting “permanent” persistent login cookies a bad practice?

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years: cookies....
5
votes
4answers
4k views

Persistent RESTful state on client without cookies

I'm reading Roy Fielding's dissertation Architectural Styles and the Design of Network-based Software Architectures, which introduces the REST architectural style. Roy explains that cookies are a ...
3
votes
1answer
103 views

Is “friendly fire” session replay a valid concern?

I've been reading a lot about sessions and security, trying to learn as much as possible before writing too much code. I've read about limiting session replay by including a timestamp within the ...
26
votes
5answers
9k views

Why can't we use IP address instead of cookies in identifying the client in servlets?

I know we have some extra advantages in using the cookies over IP address, but my question is Why can't the container just remember the IP address of the client in identifying the client when he visit ...
0
votes
1answer
1k views

How to update last accessed with Forms Authentication cookie

I've got an MVC 4 site where I'm using Forms Authentication. I'm setting a cookie when a user logs in. The majority of my site does NOT require a user to be logged in though. What I'd like to do, ...
0
votes
0answers
52 views

Redirection methods for webpages

(This is question involving user experience, but I am primarily interested in the best practice technical solution to this common problem.) There are several places in my website where users are ...
0
votes
2answers
518 views

How can I handle Bots in a site that creates a database item every page

I have an eCommerce platform that creates a basket as soon as the user lands on the site if they don't already have one (from session or cookies). It then stores the basket information in session and ...
0
votes
1answer
621 views

Should I save a simple list cookie in Javascript or PHP?

I am currently making a simple list tool. You can click a checkbox to mark it as done and if you navigate away from the page/close the browser and reload, it will still be saved. So it's pretty much ...
0
votes
2answers
3k views

If we close browser window without getting logout, what will happen when we provide same URL in the browser?

A few days ago, I appeared in an interview in a software company for .net developer. There I was asked the following question: If we close browser window without getting logout, what will happen ...
3
votes
2answers
392 views

Is it correct to require end-users to clear their cookies?

Is it any indications of poor programming if the support staff for a given product requires you to clear the cookies in order to troubleshoot issues with their web-site? As a point of example, if you'...
1
vote
1answer
99 views

Is there a tool or process to help FOSS authors agree on a license? [closed]

The Evercookie project has several contributors and there is no explicit license for the code. There is currently discussion on the dev mailing list trying to figure out what the licensing options ...
4
votes
1answer
3k views

Controlling cookies with many tabs

I have a peculiar problem. My application has different levels of authentication. One specific level of user (super user) needs to be able to use the application as another user (subordinate user) ...
1
vote
3answers
5k views

Is path in Set-Cookie URL encoded?

I'm writing some code that sets cookies and I'm wondering about the exact semantics of the Set-Cookie header. Imagine the following HTTP header line: Set-Cookie: name=value; Path=/%20 For with path ...
-1
votes
2answers
640 views

should F12's request headers show session id as cookie?

I'm trying to educate myself on potential web attacks. I just found a site (which will rename anonymous) where it shows me what looks to be like the php session id inside the cookies section of the ...
3
votes
1answer
3k views

Understanding HTTP Cookies in Indy 10 for Delphi XE2

I have been working with Indy 10 HTTP Servers / Clients lately in Delphi XE2, and I need to make sure I'm understanding session management correctly. In the server, I have a "bucket" of sessions, ...
1
vote
2answers
123 views

Cookie Settings Storage Method

I've got an web app that needs to store some non-sensitive preferences for the user. Right now I'm storing their language preference and what mode they want a window opened in by default in two ...
8
votes
2answers
1k views

If I drop cookies with JavaScript will it still be compliant with the EU ICO Cookie Law?

The challenge proposed to me as to create a widget to apply in other sites that makes a website compliant with the cookie law[1]. Can I do this without changing server code? I mean, if there's code ...
5
votes
5answers
841 views

How to implement a no-login authentication system

I am looking to build a very loose authentication system that can track a user and link submitted data/comments to a specific user. The submissions are essentially anonymous, but a user may want to ...
10
votes
4answers
2k views

How will we be able to produce websites without using cookies with the new law? [duplicate]

Possible Duplicate: How do I comply with the EU Cookie Directive? Under this new EU law we are not allowed to use any cookies without asking first, I for one need to use a cookie to register ...
17
votes
3answers
1k views

How do I comply with the EU Cookie Directive?

On 26 May 2011, a new EU directive comes into force that users accessing websites should now be asked for permission to allow the website to store cookies containing information about them and their ...
13
votes
3answers
1k views

Why are requests for static content being sent to another site?

Whenever I login to stackoverflow or some sites I see lots of requests for sites like http://cdn.sstatic.net/. Why is this done rather than serving directly from the actual site? How does it help to ...