News for hackers. Stuff that matters.

A comment on RFC 6896 – Secure Cookie Sessions for HTTP. Parent comment

Re:RFC 6896 – Secure Cookie Sessions for HTTP by 0xfffff on Friday December 21, 2018 @11:14AM (#18734218)
Correct, it doesn't. If you grab that cookie and then pass the cookie from somewhere else it will work.

Section 7.2.3 talks about cookie theft.

[ Parent | on HN ]
Re:RFC 6896 – Secure Cookie Sessions for HTTP by kerng on Friday December 21, 2018 @11:22AM (#18734287)
Yeah, as others have pointed out this RFC is from 2013 - so a bit dated.
[ Parent | on HN ]