LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-10-2016, 08:43 AM   #1
halfpower
Member
 
Registered: Jul 2005
Distribution: Slackware
Posts: 241

Rep: Reputation: 31
Question Do clear text cookies compromise HTTPS?


Let's say that a cookie is set while a user is communicating via HTTP. This user then communicates with the same server via HTTPS and continues to use the same cookie. Does the clear text cookie compromise the security of HTTPS?
 
Old 02-10-2016, 10:44 AM   #2
fmattheus
Member
 
Registered: Nov 2015
Posts: 104

Rep: Reputation: 38
Yes because the cookie could have been grabbed by a MITM. He can then use it to take over your session.
 
Old 02-14-2016, 07:06 PM   #3
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,676
Blog Entries: 4

Rep: Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945
... but, if the server-side software is implemented at all properly, the cookie won't work. Browsers won't serve https cookies to non-https sites and vice-versa; not even if the URL is the same. Most session-handling packages on the server side also recognize the difference between secure and non-secure and will neither issue nor accept the same cookie value in both sides.

Cookies, IMHO, should always be random, salted values that are aggressively tested on the server side. The IP-address should be the one to which they were issued; the protocol and security should be the same; the token should not be too old. And so on. Session management packages which do these things are readily available, and should be used.

Cookies, of course, should never "contain" information. All such things should be stored in server-side session storage. Furthermore, care must be taken to ensure that client-side data and scripts(!) are never "trusted." Even in HTTPS mode.

Last edited by sundialsvcs; 02-14-2016 at 07:21 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] SSH and clear text passwords mattydee Slackware 12 08-22-2012 10:01 AM
TKinter text widget clear rockharley Linux - Newbie 4 08-15-2012 08:50 PM
.htaccess and clear-text password noir911 Linux - Server 1 05-12-2008 12:55 PM
Passwords sent in clear text? Synesthesia Linux - Security 4 08-19-2006 10:35 AM
phpldapadmin & clear text cookies [GOD]Anck Linux - Security 4 01-31-2005 07:41 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 08:53 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration