We’ve all been harassed with the following request:

This website uses cookies … Please accept to continue

Oh yeah!

Cookies are data that are collected from websites that you visit and are stored on your own computer so that when next you visit that same website, the website remembers who you are, what your preferences are, what you have in your cart, etc.

Cookies are part of the http protocol which most applications have come to rely on, and which sadly can also be subject to exploitation.

Cookies enable servers to send items of data to the client, which the client stores and resubmits back to the server. Unlike the other types of request parameters (those within the URL query string or the message body), cookies can also be resubmitted in each subsequent request without any particular required interaction with the user or the application itself.

Cookies consist of a name/value pair, but they can also consist of any string that does not contain a space. Multiple cookies can be issued by using multiple Set-Cookie headers in the server’s response, and are all submitted back to the server in the same Cookie header, with a semicolon separating different individual cookies.

In addition to the cookie’s actual value, the Set-Cookie header can also include any of the following optional attributes, which can be used to control how the browser handles the cookie:

  1. expires — This is used to set a date until which the cookie is valid. This will cause the browser to save the cookie to persistent storage, and it will be reused in subsequent browser sessions until the expiration date is reached. If this attribute is not set, the cookie will only be used in the current browser session.
  2. domain — This is used to specify the domain for which the cookie is valid. This must be the same or a parent of the domain from which the cookie is received.
  3. path — This is used to specify the URL path for which the cookie is valid.
  4. secure – If this attribute is set, then the cookie will only be submitted via HTTPS requests.
  5. HttpOnly — If this attribute is set, then the cookie cannot be directly accessed via client-side JavaScript, although not all browsers support this restriction.

Cookies are not inherently bad in themselves, but the attributes set on a cookie can seriously impact the security of the application and make it vulnerable to malicious attacks.

Author

Recent Posts

Apple is developing a doorbell camera equipped with Face ID technology.

Apple is reportedly developing a new smart doorbell camera with Face ID technology to unlock…

14 hours ago

Google Launches Its Own ‘Reasoning’ AI Model to Compete with OpenAI

This month has been packed for Google as it ramps up efforts to outshine OpenAI…

3 days ago

You can now use your phone line to call ChatGPT when cellular data is unavailable.

OpenAI has been rolling out a series of exciting updates and features for ChatGPT, and…

4 days ago

Phishers use fake Google Calendar invites to target victims

A financially motivated phishing campaign has targeted around 300 organizations, with over 4,000 spoofed emails…

5 days ago

Hackers Exploiting Microsoft Teams to Remotely Access Users’ Systems

Hackers are exploiting Microsoft Teams to deceive users into installing remote access tools, granting attackers…

6 days ago

Ethical Hacking Essentials

Data plays an essential role in our lives.  We each consume and produce huge amounts…

1 week ago