CODEWITHSUNDEEP
javascriptsecuritywebcookies
porton
porton

Reputation: 5805

Is Path attribute of cookies secure against JavaScript?

My JavaScript application may be run in a subfolder at a strange web server.

Is setting Path attribute of a cookie secure enough to prevent stealing secret data (with money!) from a user for whom I set the cookie by programmers managing other folders of the same server?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies :

The Path attribute indicates a URL path that must exist in the requested URL in order to send the Cookie header.

Here it's said nothing about that the path must exist also in the requested URL also in order to allow JavaScript code of this path to retrieve the cookie.

Is it also secure when JavaScript History API is used to change the URL of the page without reloading?

Upvotes: 1

Views: 420

Answers (1)

porton
porton

Reputation: 5805

It is not secure:

https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie#Security :

It is important to note that the path attribute does not protect against unauthorized reading of the cookie from a different path. It can be easily bypassed using the DOM, for example by creating a hidden <iframe> element with the path of the cookie, then accessing this iframe's contentDocument.cookie property. The only way to protect the cookie is by using a different domain or subdomain, due to the same origin policy.

Upvotes: 2

Related Questions