Geek Answers Handbook

Cookies protected against hijacking via http

I see facebook sending cookies via http. How are they protected from theft? If I were to copy the cookie to another computer, would I be logged in?

+4
source share
3 answers

You just described Session Hijacking, and this is a real security issue. This can be avoided in a number of ways . The easiest way to protect cookies, however, is to ensure that they are encrypted over the cable using HTTPS, not HTTP.

+6
source

Cookies sent over HTTP (port 80) are not protected because the HTTP protocol is not encrypted.

Cookies sent over HTTPS (port 443) are secure as HTTPS is encrypted.

So, if Facebook sends / receives cookies via HTTP, they can be stolen and dishonored.

+1
source

Cookies sent via HTTP are unsafe, those sent via HTTPS are slightly more secure than HTTP, but they can still be stolen, as several methods have been discovered recently to crack SSL. A full record of session capture and all attacks related to session capture can be found here: http://cleverlogic.net/tutorials/session-hijacking-0 . There is also a little bit about session capture prevention.

0
source

More articles:


All Articles