Death to Cookies
summary
A demo web app called recipe-tastic exposes why cookie-based auth fails: simple guessing, XSS stealing cookies (mitigated by HttpOnly and CSP), CSRF (fixed with anti-CSRF tokens or checking Origin/referrer), and network sniffs like Firesheep on open Wi‑Fi (fixed by SSL). Compression attacks BREACH/CRIME leak tokens unless compression is disabled or tokens are masked. Signed/encrypted cookies don’t stop replay. Practical alternatives shown include rotating cookies, enforcing SSL, and sending a custom Authorization header from clients (used by travis ci).
AI-written summary · about
chapters (9)
- 0:00Start
- 4:15Guessing
- 6:49Content Security Policy
- 12:32VBScript did not fully implement Same Origin
- 13:24cookie tossing
- 13:52Can we trust browser plugins?
- 15:15encrypting cookies does not help
- 18:10turn off SSL compression
- 19:36Custom Authorization header
related talks
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
49mCookie Security Myths and Misconceptions
43mIf you Give a Hacker a Cookie
42mHack Me If You Can
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
50mSecure Authentication and Session Management
18mWriting an (in)secure webapp
55mWeb Application Security: Browsers Fight Back!