Cookies

• Needed to maintain state in stateless HTTP
• Useful for e-commerce (e.g. implementing a shopping basket)
• Format:

  Name=VALUE; expires=DATE; domain=DOMAIN; path=PATH; secure
  

• Example:

  www.in.gr	FALSE	/	FALSE	2051222309	SITESERVER	ID=8b048791364ee52dfc1d627045d5c58c
  .google.com	TRUE	/	FALSE	2147361448	PREF	ID=33a5ab94b4a12719:LD=en:CR=2:TM=1070212757:LM=1074012764:S=bEbIgrJZzBGyc5LD
  .yahoo.com	TRUE	/	FALSE	1271361609	U	mt=Kl4g_p8MhYuN9bHjdexUb81uQuDrHYcx_oFi1Q--&ux=Sqf7/A&un=febgmfte1juft
  

• Only the same host can access a cookie

• The cookie file stores unencrypted personal data over an extended period
• Can be subverted by DNS spoofing
• Therefore an attacker can access personal data (e.g. shopping habits)
• Other users of a machine can access the cookie file
• Problems when cookies are used to make authorisation easier

• PreviousJavascript
• Contents
• NextUser Authentication

 Last change: Wednesday, June 23, 2004 11:03 am
 Unless otherwise expressly stated, all original material on this page created by Diomidis Spinellis is licensed under a Creative Commons Attribution-Share Alike 3.0 Greece License.