Importance of Cookie

Hi, Today I'm going to explain you the importance of cookie in web communication. Let us begin with understanding what exactly a cookie is;

Since HTTP is a stateless protocol,Every request sent by the user to server would be treated as the first request itself,server does not know about the previous request sent by the user. The request surpasses the conventional communication flow such as Three way handshake before TCP connection being established and encrypting the request if SSL is implemented etc. This goes well with the static web pages which didn't have authentication or authorization, anyone could access the URL and view the web application but with the enhancements of web applications increasing day by day from conventional contact me pages to modern e-commerce sites, the authentication and authorization mechanisms became the need of the hour

Although authentication and authorization are used synchronously there is a slight difference between the two

Authentication: The process through which only a legitimate user can access the application, the authentication may include simple username passwords combination to complex bio-metric scans such as IRIS. So a user upon logging into an application through the login setup is called an authenticated user.

Authorization: The process through which the authenticated user gets access to the resources only accessible to his role. To explain in a better way let us consider the scenario of an banking web application.Before making any transaction the user should first login to the bank application after which he would become the authenticated user, once the user has logged in, he should have access to only the resources that are applicable for his role, such as making transactions with his bank account, viewing the statement etc but he should not be able to view/use other's account .Similarly the bank executive would have access to the statements of all the users under his branch but he cannot make any transactions with these accounts. This process of separating the same bank application between its users according to the roles defined is called authorization

Now, let us get back to our discussion so web applications need authentication and authorization as a must, but using stateless protocol such as HTTP would require the user to send his login details on each and every request sent to the server which would be cumbersome to the user and in highly attack prone since capturing any single request would give the attacker everything he require to access the user account.

So, how can this problem be eradicated?
Well,Every programming language/framework has the inbuilt session handling functions which aid in authenticating and authorizing users without sending login credentials in every request. When the user logs in to the application for the first time a session is generated which is identified by a session identifier, the client request would have this session identifier in every request and the server uses this identifier to validate whether the user is legitimate

So now the next big question : how is this session identifier stored and accessed??

There are two ways to do it
Ø   Sessions 

Ø  Cookies


Sessions: Sessions can be regarded as tokens that are stored at the server side of the application which would validate the user until the browser is closed which means the sessions identifiers validate the user request and once the user closes his browser the session would be terminated requiring a user to re-login to access the application 

Cookies: Cookies can be regarded as tokens that are stored in the user's browser which are appended to every user request to the server which in turn validated to check if the user is authenticated and authorized to access the particular resource, the user can block delete add or modify the user cookies, and any change to the session identifier would log out the user and the user has to re-login to access the application 

As cookies are stored into the user's browser they are more prone to attacks such as cross site scripting where the attacker accesses the user's cookie value and hijacks the user session with the session token in the cookie

Hope I have cleared your doubts if not please comment I shall address them ASAP


Comments

Post a Comment

Popular posts from this blog

Exploliting SQL injection flaws using SQLMap

A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands SQLMap SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching...
Read more

Importance of enabling Secure and HTTPOnly flag for cookies

Image
Often automated scan results give lot of false positives, some may be legitimate and some are as per design which can be omitted. Most automated scanners give medium level vulnerabilities when the session identifier cookie does not have HTTPOnly and Secure flag enabled. What exactly is the problem? What happens if these flags are disabled for a session identifier? Let me explain as follows: HTTPOnly: The Httponly flag is an additional property that is added to cookies which helps to mitigate accessing cookie information through XSS. Which means declaring a cookie to httponly will restrict the client side script from accessing the cookie and return an empty string Exploitation: Consider a web application which doesn't have HTTPOnly flag enabled, auth_token is the session identifier of the application,upon executing the <script>alert(document.cookie)</script> in the application the output would be  Now let us enable the HTTPOnly flag on the s...
Read more

My encounter with successful social engineering attack

11/8/2018 9:41 AM - I was getting ready to Office when I received a call from one of our relatives, He was telling me about a hacking attempt on his email address due to which he was unable to receive any mail from yesterday, and an email is sent to all his contacts that he is in a life threatening situation in another country and he need money immediately. As a precaution he has changed his password but the issue didn't resolve. He was worried that his company's email and sensitive information is lost. He inquired if I can help him out since I was working in IT, I felt this was a opportunity for me to see hacking attempt first hand, I wanted to spend some time investigating in it, so I've asked him to share his mail details(Which is highly not recommended but at the situation I couldn't help it) and told him I'm heading to office and will have information by evening. This excitement to see what happened got the better off me, so I stayed back at home logging in...
Read more