Cookies Lack Integrity: Real-World Implications
Usenix Security Symposium, 2015.
A cookie can contain a \"secure\" flag, indicating that it should be only sent over an HTTPS connection. Yet there is no corresponding flag to indicate how a cookie was set: attackers who act as a man-in-the-midddle even temporarily on an HTTP session can inject cookies which will be attached to subsequent HTTPS connections. Similar attac...More
Full Text (Upload PDF)
PPT (Upload PPT)