PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Web Storage: the lesser evil for session tokens

portswigger.net | research | #web-security | #cookies | #session-tokens | #localstorage | #web-storage
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle argues Web Storage (sessionStorage/localStorage) is often a safer home for session tokens than cookies, examining the Secure flag, HttpOnly and the path attribute.
Published
Collected

Related coverage

research · portswigger.net
Cookie Chaos: How to bypass __Host and __Secure cookie prefixes
Unicode whitespace bypasses __Host- and __Secure- cookie prefixes: browsers treat the cookie as unrestricted, but servers such as Django and ASP.NET trim the character and honour the protected name.
research · portswigger.net
Bypassing WAFs with the phantom $Version cookie
Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.
research · portswigger.net
Stealing HttpOnly cookies with the cookie sandwich technique
The cookie sandwich technique wraps a session cookie between quoted values and legacy $Version attributes, making Tomcat misparse the header and expose HttpOnly cookies to scripts.
research · xbow.com
The Campaign Is Not Available in Your Country: XBOW Discovered an SQLi While Attempting to Bypass Geolocation Restrictions.
Narrates XBOW's dogged SQL injection hunt after geolocation blocks: header and user-agent spoofing failed, but a cookie pivot into a /non_participating/ endpoint broke through.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
research · vercel.com
Security boundaries in agentic architectures
A framework for drawing security boundaries in agentic architectures. Most agents run with zero isolation between the agent and the code it generates. Learn where to draw the boundaries, from secret injection to full application sandboxing.
Back