TechKnowSurge

VideoSecurityFree

Secure Cookies

Secure cookies are a server-side setting that instructs browsers to encrypt and restrict cookie data, protecting user sessions from hijacking and unauthorized cross-site access.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Cookies are small data files stored on a user's device by the websites they visit, designed to preserve session information between visits. Common use cases include maintaining login state, saving shopping cart contents, storing personalization settings like display preferences, and enabling behavioral tracking for targeted advertising. Without cookies or similar mechanisms, users would lose their progress every time a browser session ends, making the browsing experience fragmented and frustrating. Despite their utility, cookies present two significant security and privacy concerns. First, because cookies can contain records of user activity across multiple sites, a malicious or negligent site can read that data and build a profile of a user's broader online behavior — a practice at the center of ongoing privacy debates. Second, cookies that store session state are vulnerable to session hijacking, where an attacker intercepts or steals a cookie and uses it to authenticate as the legitimate user on a target site. The secure cookie flag addresses these risks at the application level. Set on the server side by developers, this flag instructs the client browser to encrypt the cookie, scope it to the originating site, and prevent other sites from accessing its contents. Major browsers including Chrome, Safari, Edge, and Firefox enforce these restrictions when the flag is present, making it a foundational control for any web application that handles authenticated sessions or sensitive user data.

What you'll learn

Explain the purpose of browser cookies and the security risks they introduce, including privacy exposure and session hijacking
Describe how the secure cookie attribute mitigates cookie-based attacks by restricting cookie transmission and access across sites

What's covered

Securing Cookies

What Are Cookies
- Stored on User Machines
- Created When Site Visited
Cookie Use Cases
- Session Management
- Personalization Settings
- User Tracking
Cookie Security Risks
- Privacy Concerns
  - Reading Browse History
  - Targeted Marketing
- Session Hijacking
  - Stolen Cookie Access
Secure Cookie Implementation
- Enabled Server Side
- Browser Enforces Security
- Encrypted and Site-Locked

Key terms

Cookie: A small data file stored on a user's device by a web browser to track session state, preferences, and user activity across visits to a website.
Session Hijacking: An attack in which a threat actor takes over an authenticated session by stealing or forging the session token, gaining unauthorized access to resources without needing the user's credentials.
Secure Cookie: A cookie attribute set server-side that instructs the browser to encrypt the cookie and restrict its transmission to trusted sites only, reducing exposure to theft.
Encryption: The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.
Confidentiality: The principle that information is accessible only to those authorized to access it.

Topics

Secure Cookies Session Management Web Security Cross Site Scripting Session Hijacking Http Headers Application Security

Transcript

Another thing that we're going to want to do on our application, if we're using some sort of cookies, is secure those cookies.

What cookies are

Let's first discuss what cookies even are. If a user makes it to a website, probably what's happening is they might log into the system, they might enter some information, they might add something to a shopping cart — there are different things that they would do at this site. Now, let's say in this example their browser accidentally gets shut down and they go back to that site. Now they've lost everything. That would be frustrating. Maybe they're going through lessons, and then they come back and it didn't track how far they were on one of the lessons. That would be frustrating.

One of the ways that we can track where they're at, what they've done, and whether they've logged in or not, is through the use of cookies. What will happen is when you visit a site, it will create one of these cookies, and it will track different things about your interaction, like whether you've logged in or not; if you've logged in, what account you have logged in; and if you've logged in, do you have anything added to the shopping cart. There are other mechanisms that can do that as well, but one of those mechanisms is these cookies. And it's stored on the individual's machine — whoever is visiting that website, it's on their machine that those are stored.

What we use cookies for

What do we use it for? Well, session management: when they log in, we can track that kind of stuff. Personalization, so that way you're not resetting up — maybe you set up dark mode on a site, and you come back and it's light mode again. We kind of like that stuff to be captured, so that way when we come back it's going to be dark mode again. Or some sort of tracking, so that way they can track what products you have seen on our site, so that way we can market those products to you.

Privacy and session hijacking

But of course this introduces a big problem with privacy. That is, if you go to a site and they say, "Okay, well, I'm going to retrieve information from your cookies," so that way I know what you were doing on our site last and where you left off at — but at the same time, I'm also going to see what else you went and did. So for instance, what Google searches did you end up doing? And if I see what Google searches that you ended up doing, or Yahoo or YouTube or Facebook or whatever searches that you did, now what I can do is I can start marketing towards you. This is a big privacy concern, because now they are reading exactly where we've been, and what data has been collected on us — they see all of that.

Another issue with this is session hijacking. Session hijacking would be that these cookies sometimes store the state of where we're at at a single site. And so if somebody wants to take over that site, they can steal the cookie, which has information, and then they can use that cookie to access that site.

Secure cookies

So one thing that we can do is we can use secure cookies. Cookies have a setting on them of whether they're secure or not. And so we as programmers, as the one that is in charge of the applications, would be the one that would switch that on. So we'd switch it on on the server side. Then what would happen is when that cookie is created, it's created on the client side, and the client browser really decides what it's going to do with that cookie and how it's going to secure that cookie. But essentially Google Chrome or Safari or Edge or Firefox — any one of those — is going to do what it can do to secure these cookies, to encrypt it, to make sure it's locked down to certain sites and make sure that other sites then can't access it.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →