Who Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies
summary
An automated test framework generates hundreds of web scenarios and applies them to 7 browsers and 46 extensions, producing a register of requests via a proxy and flagging cookie leaks. The evaluation finds bypasses across every tested protection, including JavaScript/ PDF-viewer leaks in Chrome and Opera and mis-handled SameSite default semantics (pre-render requests sending strict cookies as relaxed). A crawl of Alexa top 10k finds few in-the-wild exploits, and fixes require multiple browser releases.
AI-written summary · about
chapters (11)
- 0:00Intro
- 2:19Cross-site request forgery (CSRF)
- 6:40Client-side cookie policies
- 8:27Lines of code for Firefox
- 12:38Test-case generation
- 15:03Framework design
- 18:32Results: built-in browser policies
- 19:50Results: browser extensions
- 21:16Browser evaluation framework
- 22:03Further Evaluation of the framework
- 23:17A note on relevance
