News for hackers. Stuff that matters.

A comment on RFC 6896 – Secure Cookie Sessions for HTTP.

Re:RFC 6896 – Secure Cookie Sessions for HTTP by kerng on Friday December 21, 2018 @11:04AM (#18734131)
This doesn't seem to protect from Pass the Cookie attacks.

Edit - it's a common red teaming tactic: https://wunderwuzzi23.github.io/blog/passthecookie.html

[ Parent | on HN ]
Re:RFC 6896 – Secure Cookie Sessions for HTTP by 0xfffff on Friday December 21, 2018 @11:14AM (#18734218)
Correct, it doesn't. If you grab that cookie and then pass the cookie from somewhere else it will work.

Section 7.2.3 talks about cookie theft.

[ Parent | on HN ]
Re:RFC 6896 – Secure Cookie Sessions for HTTP by kerng on Friday December 21, 2018 @11:22AM (#18734287)
Yeah, as others have pointed out this RFC is from 2013 - so a bit dated.
[ Parent | on HN ]