Cookie Theft and Session Hijacking
| This section may contain original research. |
| This section does not cite any references or sources. |
Most websites use cookies as the only identifiers for user sessions, because other methods of identifying web users have limitations and vulnerabilities. If a website uses cookies as session identifiers, attackers can impersonate users’ requests by stealing a full set of victims’ cookies. From the web server's point of view, a request from an attacker has the same authentication as the victim’s requests; thus the request is performed on behalf of the victim’s session.
Listed here are various scenarios of cookie theft and user session hijacking (even without stealing user cookies) which work with websites which rely solely on HTTP cookies for user identification.
Read more about this topic: HTTP Cookie
Famous quotes containing the words cookie, theft and/or session:
“Living by basic good-mothering guidelines enables a mom to blend the responsibilities of parenthood with its joys; to know when to stand her ground and when to be flexible; and to absorb the lessons of the parenting gurus while also trusting her inner voice when it reasons that another cookie isn’t worth fighting over, or that her child won’t suffer irreparable trauma if, once in a while, Mom puts her own needs first.”
—Sue Woodman (20th century)
“Men are not therefore put to death, or punished for that their theft proceedeth from election; but because it was noxious and contrary to men’s preservation, and the punishment conducing to the preservation of the rest, inasmuch as to punish those that do voluntary hurt, and none else, frameth and maketh men’s wills such as men would have them.”
—Thomas Hobbes (1579–1688)
“The bar is the male kingdom. For centuries it was the bastion of male privilege, the gathering place for men away from their women, a place where men could go to freely indulge in The Bull Session ... the release of the guilty anxiety of the oppressor class.”
—Shulamith Firestone (b. 1945)