Unit 4: Cookies and sessions · Lesson 2 of 6 · 16 min

Cookie flags

Each attribute closes one way a session cookie can be stolen or misused.

mission

You are
The analyst reviewing the shop's sign-in.
Situation
The team lead wants every cookie the shop sets checked against a protected baseline.
Goal
Read each cookie's attributes in the browser and compare them with the baseline.
Hand in
A table of cookies with the attributes each one is missing.

A well-protected session cookie

Set-Cookie: sid=4c1e...; Secure; HttpOnly; SameSite=Lax; Path=/
  1. 1sid=4c1e...the value is the key to the account
  2. 2SecureHTTPS only
  3. 3HttpOnlypage scripts cannot read it
  4. 4SameSite=Laxnot sent on most cross-site requests
  5. 5Path=/sent for the whole site
01

Read the sign-in response

The lab browser is on the sign-in result. Its response headers hold the raw Set-Cookie lines.

you should see Three Set-Cookie lines with different attributes.

02

Open the Cookies tab

The browser's cookie store shows the same cookies, with the attributes it kept.

you should see Session cookies have no expiry. The theme cookie lasts a year.

03

Follow the cookies to the next page

Open /account and read the request headers.

you should see One Cookie header carrying all three values, but none of the attributes. Attributes are instructions for the browser, the server never sees them again.

Flip the flags

Set-Cookie: shop_session=7f3a9c2e41d8b6a5; Path=/; SameSite=Lax
  • sentPage script on shop.internal reads document.cookieScripts, including injected ones, can read it
  • sentRequest to http://shop.internalSent in clear text where anyone on the path can read it
  • sentRequest to https://shop.internalSame site, encrypted
  • sentLink from another site opens the pageLax and None allow top-level navigation
  • blockedForm or fetch from another siteLax and Strict block it, which stops most CSRF
Turn attributes on and off and watch which requests still carry the cookie.

The session cookie

Shop today
shop_session=...; Path=/; HttpOnly; SameSite=Lax

Travels over plain HTTP too.

Baseline
__Host-shop_session=...; Path=/; Secure; HttpOnly; SameSite=Lax

__Host- forces Secure, Path=/ and no Domain.

What a defender takes away

  1. 1Secure, HttpOnly and SameSite each close a different hole.
  2. 2Attributes are read by the browser only; the server sees name and value.
  3. 3Long-lived cookies should never carry anything sensitive.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.