Other nomination

The Cookie Monster in Your Browsers

filedescriptor · Speaker Deck · 23 August 2019

A subdomain can force duplicate cookies onto its parent, while oversized cookies can make servers reject requests and legacy comma splitting can inject additional cookie values. The slides combine these browser/server discrepancies into CSRF token fixation, HttpOnly bypasses, and theft of OAuth authorization codes from blocked redirects.

Record

Researcher

filedescriptor

Published by

Speaker Deck

Date

23 August 2019

Format

Slides

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Related sources

• Talk recording

Tags

• cookie
• csrf
• session-fixation
• parser-differential
• oauth
• xss
• header-injection
• dos
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of filedescriptor, first published at the original source. Preserved copies are kept so the citation survives its host.