Cookies

Sep 28, 26

There was supposed to be an article here, but everything has already been said.

Cookies are evil. They serve no purpose other than violating privacy and compromising security.

Vulnerabilities introduced by cookies
  1. Supercookies The original dot-counting rule let any site set a cookie for all of .co.uk. Patched by the Public Suffix List (2007), which is maintained by hand.
  2. Cross-site tracking Third-party cookies follow the user across sites. Blocked by Safari (2020), partitioned by Firefox (2022); Chrome gave up in 2024.
  3. Cookie theft via XSS Any script on the page reads document.cookie. Patched by HttpOnly (2002), opt-in.
  4. CSRF Any site makes the browser send an authenticated request. Patched by tokens in every framework, then SameSite (2016), on by default in Chromium browsers since 2020.
  5. Session fixation The attacker plants a known session ID before login. Patched in application code.
  6. Cross-site tracing The TRACE method echoes the cookie back to a script, bypassing HttpOnly. Browsers banned TRACE.
  7. XSSI and JSONP leaks A <script> tag pointing to another origin carries cookies and leaks the authenticated response. Patched by unparseable prefixes, then CORB (2018).
  8. Cross-site leaks Timing, errors, and frame counts of authenticated cross-site responses reveal the user's state. Mitigated by Fetch Metadata (2019), CORP, and COOP (2020), all opt-in.
  9. Clickjacking A framed page is still authenticated, so a disguised click acts as the user. Patched by X-Frame-Options (2009), opt-in.
  10. Login CSRF The attacker logs the victim into the attacker's account. Patched in application code.
  11. Client-side trust State kept in a cookie is attacker-controlled input: ASP.NET's encrypted cookies fell to a padding oracle, unsigned and serialized ones are simply edited. Patched in application code.
  12. Sidejacking Firesheep hijacks sessions on open Wi-Fi with one click. Secure had existed since 1994, unused. Patched by HSTS (2012), opt-in.
  13. BEAST, CRIME, BREACH, POODLE The same secret is resent with every request, so it can be guessed byte by byte. Patched by removing TLS compression and SSL 3.0; BREACH is only mitigated.
  14. Cookie tossing A subdomain or a plain HTTP response overwrites the cookies of an HTTPS site. Patched by the __Host- prefix (2016), opt-in by cookie name.
  15. Cross-site WebSocket hijacking The handshake carries cookies and is exempt from the same-origin policy. Patched in application code.
  16. Cookie bomb Oversized cookies make the server reject every request. Not patched.
  17. CORS with credentials A server that reflects Origin and allows credentials lets any site read authenticated responses. Patched in application code.
  18. Prefix bypass Browsers and servers parse the Cookie header differently, so a tossed cookie passes for a __Host- one. Patched per framework.
  19. Session replay A cookie is a bearer token: malware copies it and skips the second factor. Device Bound Session Credentials shipped in Chrome for Windows in 2026.