Top 10 winner

Cookie Crumbles: Breaking and Fixing Web Session Integrity

Marco Squarcina, Pedro Adão, Lorenzo Veronese and Matteo Maffei · USENIX Association · 9 August 2023

Studies cookie integrity across browsers and server frameworks and shows that the Secure attribute, cookie prefixes, SameSite and synchronizer CSRF tokens can be composed or implemented in ways that still allow session fixation and cross-origin request forgery. Nine of the top thirteen frameworks were affected, producing twelve CVEs and changes to the cookie standard.

Record

Researcher

Marco Squarcina, Pedro Adão, Lorenzo Veronese and Matteo Maffei

Published by

USENIX Association

Date

9 August 2023

In the archive

• Ranked #9 in the 2023 Top 10 Web Hacking Techniques

Related sources

• Talk recording

Tags

• cookie
• session-fixation
• csrf
• parser-differential
• cve
• measurement-study
• mitigation
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Marco Squarcina, Pedro Adão, Lorenzo Veronese and Matteo Maffei, first published at the original source. Preserved copies are kept so the citation survives its host.