Contents
Using the HttpOnly tag when generating a cookie helps mitigate the risk of client-side scripts accessing the protected cookie, thus making these cookies more secure. If the HttpOnly flag is included in the HTTP response header, the cookie cannot be accessed through the client-side script.
HttpOnly and secure flags can be used to make the cookies more secure. When a secure flag is used, then the cookie will only be sent over HTTPS, which is HTTP over SSL/TLS. When the HttpOnly flag is used, JavaScript will not be able to read the cookie in case of XSS exploitation.
Can HTTPOnly cookies be stolen?
Because cookie data (and session IDs) can be stolen using Cross-Site Scripting (XSS), it is important to set cookies as being HTTPOnly. This setting makes cookies unavailable to JavaScript and prevents their theft using XSS. Cookies can also be configured as “secure cookies” or “https-only cookies”.
How do you implement Remember Me function?
Using Cookies to implement a RememberMe functionality
- your login panel must contain a “Remember Me” check.
- after a succesfull login with “Remember Me” check selected, you can create two cookies: one to keep the value for rememberMe and one to keep a token which has to identify the logged user.
You should never store sensitive data in a cookie, such as user names, passwords, credit card numbers, and so on. Do not put anything in a cookie that should not be in the hands of a user or of someone who might somehow steal the cookie.
One way of providing additional validation is by including the user’s IP address / user agent / other distinguishing feature in the “remember me” cookie. The rationale is that this offers some defence against hijacking of the cookie. The problem, of course]
Why are the cookies not set on Remember Me?
Let’s take a look at the cookies: This is a fairly impressive set of cookies but it’s the highlighted ones that are genuinely interesting. These cookies won’t get set if you don’t check the “remember me” box so their function is purely to log you back in later on.
What’s the difference between session cookie and Rememberance Cookie?
This should be a “rememberance” cookie only, NOT a session cookie – i.e. when you get that cookie without a session, reissue a new, regular session cookie. Also note that like the session cookie, this should be delivered only over https, and using the secure and httpOnly attributes, and of course have the cookie scoped properly etc.
What are the limitations of the Tor Cookie?
The obvious limitation here is that, if your IP address (or other information) changes, your cookie is useless. Some might see this as a good thing, I see it as needlessly hostile towards usability for Tor users.