Cookie Security Explained | OWASP Top 10

Introduction to Cookies

The post explains the importance of cookies in web security and how to secure them from vulnerabilities like session hijacking and cross-site scripting (XSS).

Cookies store important information in a user’s browser and are generated by the web server, acting as a user’s identity on a website. Cookies are assigned when a user logs in or performs actions on a website, making them critical for maintaining session states.

Cookies can be stolen through man-in-the-middle attacks or cross-site scripting (XSS), allowing attackers to impersonate users and potentially take over accounts.

Web Hacking Study Notes

The Complete Practical Web Application Penetration Testing Course

Examples

The video demonstrates a user logging into a website (test.com) and shows how cookies are assigned through the session identifier to track user actions on the website.

The instructor uses browser developer tools (Inspect -> Network) and the terminal (using curl) to display the PHP session ID that represents the user’s session on the website. This session ID is crucial for the user’s security and can be exploited if not protected.

Securing Cookies

HTTP Only Flag:

• This flag prevents JavaScript from accessing or modifying cookies. By setting this flag to true, the browser ensures that JavaScript on the client-side cannot manipulate cookies, protecting against XSS attacks.

Secure Flag:

• The Secure flag ensures that cookies are only transmitted over secure (HTTPS) connections. This helps prevent man-in-the-middle attacks, where attackers could intercept cookies if sent over an insecure connection (HTTP). This flag should always be set to true on websites using HTTPS.

Implementing Cookie Security

The video shows how to add the HTTP Only and Secure flags to cookies before starting the session. Two methods are demonstrated:

1. Using setcookie() Function:
   • The instructor sets the parameters for a cookie (name, value, expiration time, domain) and ensures that the Secure and HTTP Only flags are set to true.
2. Using session_set_cookie_params():
   • This alternative method configures the session cookie parameters globally, ensuring that all session cookies use the Secure and HTTP Only flags.

Key Takeaways

HTTPS is vital: While the HTTP Only flag helps secure cookies against JavaScript manipulation, it is not enough without HTTPS.

A mix of HTTP and HTTPS can expose cookies to interception.Always ensure that both flags are implemented alongside HTTPS to fully protect cookies from hijacking and session manipulation.

Video Walkthrough