10—cookie—security.pptVIP

Cookie Same Origin Policy;;;Scope setting rules (write SOP);Cookies are identified by (name,domain,path);Reading cookies on server (read SOP);Examples;Client side read/write: document.cookie;javascript: alert(document.cookie);Viewing/deleting cookies in Browser UI;Cookie protocol problems;Example 1: login server problems;Example 2: “secure” cookies are not secure;Interaction with the DOM SOP;Cookies have no integrity !!;Storing security data on browser?;*;Solution: cryptographic checksums;*;Cookie theft: basic cross site scripting (XSS);Example: reflected XSS;;*;HttpOnly Coo