Cookies and sessions


Published on

Published in: Education
1 Comment
No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Cookies and sessions

  1. 1. Cookies and Session Sukrit Gupta
  2. 2. HTTP HTTP is a stateless protocol. Does not remember what happened between two consecutive requests. Even two Requests made by same user are different for HTTP. HTTP just processes a client REQUEST and supplies the server RESPONSE.
  3. 3. We need:- To maintain state. To maintain state means the ability to retain values of variables and to keep track of users who are logged into the system. To distinguish one user from Other. To save user Preferences.  Common example: Shopping carts.
  4. 4. Methods for maintaining state Cookies Sessions Passing [hidden] variables We writing the URL
  5. 5. Why not any other method Although many details about the user (such as their browser, IP address and operating system) are available But because of  the use of dynamic IP addresses (which change every time the user logs on)  IP address sharing (so that many people share the same IP) there is no reliable way of recognizing a particular user when they re-visit a website.
  6. 6. Cookies A cookie is a small piece of data sent from a website and stored in a users web browser which can be later retrieved by the website. Also known as an HTTP cookie, web cookie, or browser cookie. Max size of a cookie is 4kB. Each browser stores at least 300 cookies in total and at least 20 cookies per server or domain.
  7. 7. A little about cookie’s origin [aka History] The term "cookie" was derived from "magic cookie", which is the packet of data a program receives and sends again unchanged. Lou Montulli (an employee at Netscape Communications) had the idea of using them in Web communications in June 1994. He used cookie to create a Virtual Shopping Cart.
  8. 8. Uses of Cookies Common uses for cookies are authentication, storing of site preferences, shopping cart items, and server session identification. Ex  Google uses cookies to provide customized pages and search results to their users.  StackOverFlow uses cookies to log in their users automatically.  Visitor tracking and statistics systems often use them to track visitors.  Google uses cookies to display interest Preferenced advertisement to the visitor using cookies in aDsense.
  9. 9. How it works Browser only sends the Name and Value of cookie with the request.
  10. 10. Ingredients of a Cookie.. General SYNTAX Cookie(Name, Value, exp. Time, path, domain, secure, httponly) Name: The name of the cookie. This name is used by the website to refer to it. The name should be unique to the website, but it doesnt matter if it clashes with the name of a cookie from another website. Value: The value of the cookie. This value is stored on the clients computer; do not store sensitive information. Expire: The time the cookie expires. This is a Unix timestamp so is in number of seconds. In other words, youll most likely set this with the time() function plus the number of seconds before you want it to expire. If set to 0, or omitted, the cookie will expire at the end of the session (when the browser closes).
  11. 11. Ingredients of a Cookie..(cont..) Path: The path on the server in which the cookie will be available on. If set to /, the cookie will be available within the entire domain. If set to /foo/, the cookie will only be available within the /foo/ directory and all sub-directories such as /foo/bar/ of domain. The default value is the current directory that the cookie is being set in. Domain: The domain that the cookie is available to. Setting the domain to will make the cookie available in the www subdomain and higher subdomains.
  12. 12. Ingredients of a Cookie..(cont..) Secure: Indicates that the cookie should only be transmitted over a secure HTTPS connection from the client. When set to TRUE, the cookie will only be set if a secure connection exists. Httponly: When TRUE the cookie will be made accessible only through the HTTP protocol. This means that the cookie wont be accessible by scripting languages, such as JavaScript. It has been suggested that this setting can effectively help to reduce identity theft through XSS attacks
  13. 13. Types Of Cookies Session cookie  A users session cookie (also known as an in-memory cookie or transient cookie) for a website exists in temporary memory only while the user is reading and navigating the website. When an expiry date or validity interval is not set at cookie creation time, a session cookie is created. Web browsers normally delete session cookies when the user closes the browser. Persistent cookie  A persistent cookie will outlast user sessions. If a persistent cookie has its Max-Age set to 1 year, then, within the year, the initial value set in that cookie would be sent back to the server every time the user visited the server. This could be used to record a vital piece of information such as how the user initially came to this website. For this reason persistent cookies are also called tracking cookies.
  14. 14. Types Of Cookies… Secure cookie  A secure cookie has the secure attribute enabled and is only used via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. HttpOnly cookie  On a supported browser, an HttpOnly session cookie will be used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs (such as JavaScript).
  15. 15. Types Of Cookies… Third-party cookie  First-party cookies are cookies set with the same domain (or its subdomain) as your browsers address bar. Third-party cookies are cookies set with domains different from the one shown on the address bar. The web pages on the first domain may feature content from a third-party domain, e.g. a banner advert run by  As an example, suppose a user visits, which includes an advert which sets a cookie with the domain When the user later visits, another advert can set another cookie with the domain Eventually, both of these cookies will be sent to the advertiser when loading their ads or visiting their website. The advertiser can then use these cookies to build up a browsing history of the user across all the websites this advertiser has footprints on.
  16. 16. Types Of Cookies… Supercookie:  A "supercookie" is a cookie with a public suffix domain, like .com,  A supercookie with domain .com would be blocked by browsers; otherwise, a malicious website, like, could set a supercookie with domain .com and get cookies of Zombie cookie  Some cookies are automatically recreated after a user has deleted them; these are called zombie cookies.  This is accomplished by a script storing the content of the cookie in some other locations, such as the local storage available to Flash content and HTML5 storages and then recreating the cookie from backup stores when the cookies absence is detected.
  17. 17. Implementation Using Php To set a cookie use  setcookie("UsersName", $name, time()+3600, "/", ".mysite.c om", 1,1);  It should be used before sending any output to the page. To Read Cookie Values  $_COOKIE[CookieName];  $_REQUEST[CookieName]; To Destroy a cookie  setcookie("user", "", time()-3600);  setcookie("UsersName", "", mktime(12,0,0,1, 1, 1990));
  18. 18. An example.. if(isset($_COOKIE[UsersName]) { echo "Hello, ".$_COOKIE[UsersName]."! Welcome back!"; } else { setcookie("UsersName",$name); }
  19. 19. Cookie security and privacy issues Cookies are NOT viruses. Cookies use a plain text format. They are not compiled pieces of code so they cannot be executed nor are they self-executing. Cookies CAN be used for malicious purposes though. Since they store information about a users browsing preferences and history, both on a specific site and browsing among several sites, cookies can be used to act as a form of spyware.
  20. 20. Cookie theft and session hijacking Network eavesdropping  Traffic on a network can be intercepted and read by computers on the network other than the sender and receiver (particularly over unencrypted open Wi-Fi).  This traffic includes cookies sent on ordinary unencrypted HTTP sessions.  An attacker could use intercepted cookies to impersonate a user and perform a malicious task, such as transferring money.  This issue can be resolved by specifying the Secure flag while setting a cookie, which will cause the browser to send the cookie only over an encrypted channel.
  21. 21. Cookie theft and session hijacking Publishing false sub-domain – DNS cache poisoning  Via DNS cache poisoning, an attacker might be able to cause a DNS server to cache a fabricated DNS entry, say with the attacker’s server IP address.  Since is a sub-domain of, victims’ browsers would submit all cookies to the attacker’s server;  This vulnerability is usually for Internet Service Providers to fix, by securing their DNS servers  But it can also be mitigated if is using Secure cookies.  Victims’ browsers will not submit Secure cookies if the attacker is not using encrypted connections.  If the attacker chose to use HTTPS, he would have the challenge of obtaining an SSL certificate for from a Certificate Authority.  Without a proper SSL certificate, victims’ browsers would display (usually very visible) warning messages about the invalid certificate.
  22. 22. Cookie theft and session hijacking Cross-site scripting – cookie theft  Scripting languages such as JavaScript are usually allowed to access cookie values and have some means to send arbitrary values to arbitrary servers on the Internet.  These facts are used in combination with sites allowing users to post HTML content that other users can see.  As an example, an attacker may post a message on with the following link:  <a href="#" onclick="window.location=; return false;">Click here!</a>  When another user clicks on this link, the browser executes the piece of code within the onclick attribute, thus replacing the string document.cookie with the list of cookies of the user that are active for the page.  When another user clicks on this link, list of cookies is sent to the server. If the attacker’s posting is on, secure cookies will also be sent to in plain text.  It is the responsibility of the website developers to filter out such malicious code.  Such attacks can be mitigated by using HttpOnly cookies.
  23. 23. Key tips for safe and responsible cookie-based Web browsing Install and keep antispyware applications updated  Many spyware detection, cleanup applications, and spyware removers include attack site detection. They block your browser from accessing websites designed to exploit browser vulnerabilities or download malicious software. Make sure your browser is updated  If you havent already, set your browser to update automatically. This eliminates security vulnerabilities caused by outdated browsers. Many cookie-based exploits are based on exploiting older browsers security shortcomings.
  24. 24. Session Session support consists of a way to preserve certain data across subsequent accesses. A visitor accessing the web site is assigned a unique id, the so-called session id. This is either stored in a cookie on the user side or is propagated in the URL. The rest of the information and variables are stored on server. Session variables hold information about one single user, and are available to all pages in one application. In PHP the session support allows to store data between requests in the $_SESSION superglobal array.
  25. 25. Session V/S Cookies A session retains data for the duration of the session. A cookie retains values for as long as you need it to. Cookies should be used to store simple data for a long period of time. If one go to the website a lot, they might want their username to be remembered for them, so it can be stored as a cookie. Critical and private data should not be stored in cookie instead sessions should be used. Cookies can be any time altered by User. Cookie might be disabled On a system so Sessions employing URL can be used. Cookies can be any time altered by User. Cookies are sent with each request so a lot of cookies can slow down the process.
  26. 26. Php Session. Starting a PHP Session  <?php session_start(); ?>  The session_start() function must appear BEFORE the <html> tag Storing a Session Variable  $_SESSION[views]=1; Destroying a Session  unset($_SESSION[views]); --used to free the specified session variable  session_destroy(); --reset the session and delete all stored session data.
  27. 27. Some pitfalls If we write session_id in url:  one might save the offline page as a bookmark or pass the link across to others not realizing that the session id information is also sent. (session fixation.)  So someone who quickly accesses these pages could possible get logged on.  To prevent this we can use cookies  But this could cause problems when dealing with transaction which involve switch sites, i.e. siteA forwards to site B for payment which forwards to siteA for thank you, in which case a phpsessid inform might be used to revive the old session.
  28. 28. Some tips:- Ensure you always use a new self generated sessionid on successful login attempt.- Use https throughout to ensure no one can sniff yoursession id.- Store session id, remote IP information and comparefor successive pages.