CODEWITHSUNDEEP
httpcookieshttps
joels
joels

Reputation: 7711

are cookies secure from hijacking over http

I see facebook sends cookies over http. How are they secure from hijacking? If I were to copy the cookie onto another computer would I be logged in?

Upvotes: 6

Views: 4261

Answers (3)

Joshua Kissoon
Joshua Kissoon

Reputation: 3309

Cookies sent over HTTP are unsecure, those sent over HTTPS are a bit more secure than HTTP, however they can still be stolen since there are a few methods discovered lately to hack SSL. A complete writeup on session hijacking and all of the session hijacking attacks can be found here: http://cleverlogic.net/tutorials/session-hijacking-0. There is also a bit on preventing Session Hijacking.

Upvotes: 0

Rob Raisch
Rob Raisch

Reputation: 17357

Cookies sent over HTTP (port 80) are not secure as the HTTP protocol is not encrypted.

Cookies sent over HTTPS (port 443) are secure as HTTPS is encrypted.

So, if Facebook sends/receives cookies via HTTP, they can be stolen and used nefariously.

Upvotes: 1

dlev
dlev

Reputation: 48596

You've just described Session Hijacking, and it is a real security issue. It can be avoided in a number of ways. The simplest way to secure the cookies, though, is to ensure they're encrypted over the wire by using HTTPS rather than HTTP.

Upvotes: 6

Related Questions