Cookie Theft and Session Hijacking
This section has multiple issues. Please help improve it or discuss these issues on the talk page.
|
Most websites use cookies as the only identifiers for user sessions, because other methods of identifying web users have limitations and vulnerabilities. If a website uses cookies as session identifiers, attackers can impersonate users’ requests by stealing a full set of victims’ cookies. From the web server's point of view, a request from an attacker then has the same authentication as the victim’s requests; thus the request is performed on behalf of the victim’s session.
Listed here are various scenarios of cookie theft and user session hijacking (even without stealing user cookies) which work with websites which rely solely on HTTP cookies for user identification.
Read more about this topic: Supercookie
Famous quotes containing the words cookie, theft and/or session:
“Living by basic good-mothering guidelines enables a mom to blend the responsibilities of parenthood with its joys; to know when to stand her ground and when to be flexible; and to absorb the lessons of the parenting gurus while also trusting her inner voice when it reasons that another cookie isn’t worth fighting over, or that her child won’t suffer irreparable trauma if, once in a while, Mom puts her own needs first.”
—Sue Woodman (20th century)
“Every gun that is made, every warship launched, every rocket fired, signifies, in the final sense, a theft from those who hunger and are not fed, those who are cold and are not clothed. The world in arms is not spending money alone. It is spending the sweat of its labourers, the genius of its scientists, the hopes of its children.”
—Dwight D. Eisenhower (1890–1969)
“The bar is the male kingdom. For centuries it was the bastion of male privilege, the gathering place for men away from their women, a place where men could go to freely indulge in The Bull Session ... the release of the guilty anxiety of the oppressor class.”
—Shulamith Firestone (b. 1945)