Is it possible to search a web page's cookie files for the cookies corresponding to a particular user?
For Example, given any of the functions defined here, I hope to be able to pass in a website URL and a name and function returns the cookie for that user(if any); All this happening when I run the script.
Or, how can I get the username from the cookies collected?
Also, When I run commands like document.cookie, it returns a dialog with some variables and values. Variable like localle, c_user, csm, sub, act, etc... What is the meaning of these variables? Is it possible to uniquely identify a cookie given the a username?
JavaScript, when embedded in an HTML document, has access to the cookies the browser has set for that page.
It cannot access cookies for a different page (unless the cookie is shared between them).
It cannot access cookies for other browsers (since the cookies are not stored in the browser running the JS).
Update re edit (which, BTW, should have been a new question):
document.cookie gives you a string containing the cookies for the document. The cookie names are determined by the author of the code that set them. They mean whatever that person wants them to mean.
Cookies can be identified by their name. Cookies do not have usernames (although the author of the code that set the cookie might store a username in a cookie).
Related
I'm new in BackboneJs and I need some help to pass parameters in URL using GET with Jersey.
In fact, I have table of documents like the following :
When I click on a PDF picto, it opens the PDF document using the documentID.
Front side (BackboneJs)
getDatas: function(e){
var clickedEl = $(e.currentTarget);
var id = clickedEl.attr("id");
window.open(window.myApp.baseUrlService.defaultUrl + '/getDocument.json?an200_idDocument=' + id);
},
So here I get the documentId and I use it in the backend to open the document.
Back side (JAVA)
#GET
#Path("/getDocument.json")
public Response getDocumentById(#QueryParam("an200_idDocument") String idDocument){
// my code here
}
It works perfectly but my problem is when I open the document, I can see the documentId which is not secure. I tried with #POST but it didn't work.
So, there is any other solution ?
Anything in the browser should be considered compromised already.
Any encryption in JS is pointless since the data is already available to the malicious party.
So how to hide the document id?
The data is not sensitive
Generally, ids are not sensitive information. Since you're already sending them to the frontend for the user to be able to ask for a specific document, they're already easily available.
Consider not worrying about these ids.
Use GUID
If the ids are currently a guessable sequence (1, 2, 3, etc.) and the user is not logged in meaning that the URL is publicly accessible, consider storing a GUID in the database for each document and use it to identify them.
/getDocument.json?an200_idDocument=123e4567-e89b-12d3-a456-426655440000
It's far less likely for someone to guess a GUID.
Make these chances close to none by namespacing with a category for example, or a user ID if the user is logged in the app.
/getDocument.json?cat=bills&an200_idDocument=123e4567-e89b-12d3-a456-426655440000
Check the permissions by object
If the user is logged in, check if he has access to the document from the backend before returning a response. If he does not have access, return a 403 Forbidden response.
Use short-lived tokens
If the document should be accessible only once for a user, consider short-lived tokens which are unique strings associated to the user or the document and they expires after X amount of times or after X document requests.
Sadly, there's no possibility to completely hide the parameters of an URL using GET, that is in fact one of the main point between GET and POST. Unless you encrypt those datas in order to hide them using GET or use a POST method, you'll have no other solution.
More details between them there : https://www.w3schools.com/tags/ref_httpmethods.asp
I understand the importance of creating cookies at server side , it is for transferring information between server and browser ,since HTTP is stateless protocol.
But I am not aware about why and when cookies are created at client side (browser).
Hope my question makes sense.
But I am not aware about why and when cookies are created at client
side (browser).
Because if you want to save for example settings for the user you can use cookies. It might be easier as setting them in php $_COOKIE (serverside).
BUT make sure it is no data which contains password or similiar - cookies can be shown in the browser
document.cookie = "name=value";
document.cookie = "username=smith"; // setting two cookies
document.cookie = "lastlogin=Dec 1 2045";
...
alert(document.cookie); "username=smith; lastlogin=Dec 1 2045"
JS has a global document.cookie field (which is a magical string with
odd behavior) when you assign into document.cookie, it actually
appends / concatenates a new cookie (an unfortunate syntax that does
not match the expected semantics of the = operator)
This can be for many reasons. I use cookies on the client side to store non-sensitive information about the user that may be useful to know the next time they access the site.
For example if I am building a shopping website. I could ask the user to pick a currency and store that in a cookie so next time the user accesses the website I can read that cookie and set the currency without prompting the user.
Often, client-side cookies is used to store key to extract stored information from database or other storage
http://screencast.com/t/mzvp9jTP
I'd like to use Facebook Login/Connect to authenticate users on my website. The system consists of two things: 1) client side use of the FB JS SDK to auth the user and to set a (fbsr_) cookie, 2) retrieve this cookie on the server side and make a request against FB backend to get their email, that I'll use as an ID. (I'll use G+ login etc as well so email looks like a good common denominator.)
I pretty much copied what's here: https://developers.facebook.com/docs/facebook-login/login-flow-for-web/
The problem is, every time I refresh the page, I see that a new fbsr_${my_app_id} cookie is created. After 10 reloads in a row, I end up with 10 cookies that have the same name (and same domain) and different content. In other words, it looks like FB.init() always creates a new cookie and doesn't re-use the previous one (which becomes invalid). My observation is based on what I see in the "Cookies" window of Firefox in this case.
Am I doing something wrong? What can I do so the FB API reuses the previous cookie and doesn't create a myriad of cookies with the same name on my domain?
Thanks!
Is there any way to POST all the cookies(cookie name , value and expire time) available for a specific domain (e.g .example.com) using javascript ? . I own the domain that I need the cookies to POST from but I want to post them to a different domain (e.g example2.com). After the cookies are POST ed I also need to redirect the client to a specific link so I think some ajax may be required
Note : I do not need to read/write cookies on different domain. I simply need to send/transport the cookies names/values/exp of the current domain to a different domain as HTTP POST values
You can access the cookies using document.cookie. However, this only gives you the name and value - there's no way (that I know of) to get the expiration date of a cookie. It contains a string with all the cookies, in a name1=value1; name2=value2; name3=value3; format.
Sending it as a POST request to another domain can be done with cross-domain XHR, but if you don't need to read the HTTP response of the request, submitting a form should be enough. Simply create an invisible <form> with its method attribute set to "post", the action attribute set to the URL on the other domain and the target attribute set to the id of an invisible iframe, add the cookies as an <input>, and submit the form.
<iframe id="foo" style="display: none"></iframe>
<form id="bar" method="post" target="foo"
action="http://www.someotherdomain.com/handle_cookies.php">
<input id="cookies" type="hidden" name="cookies" />
</form>
<script type="text/javascript">
document.getElementById('cookies').value = document.cookie;
document.getElementById('bar').submit();
</script>
Its probably better to create the <iframe> and <form> dynamically, using JavaScript, instead of having it written in the HTML, but I'm too lazy to write that at 2:30AM, sorry :P
note: If the first domain is accessed on SSL, make sure the connection to the other domain is also over SSL, otherwise you'll be transmitting secured cookies over HTTP as plain text. You can remove the scheme part from the URL of the other domain (e.g. //www.someotherdomain.com/handle_cookies.php instead of http://www.someotherdomain.com/handle_cookies.php), making it use the same scheme as the one used where the cookies are sent from. I highly recommend doing that.
The link describes a method that comes close to the requirement. But it uses the window.name property instead of cookies to send data.
Google cache copy, because the original link seized to work for a while.
Using window.name transport for cross-site POST scripting
I think due to security reasons you can't read/write a cookie for a different domain. You can apply a specific path for the cookie to be available to such as a specific folder outside of your root. I think the way the browsers work is they find cookies for the site they are accessing at the moment, and use them accordingly. But allowing for cookies to be cross domains would open up to many threats. I think, if you really want though I can't promise something like this working fully.
If you build a script on the other domain that will write a cookie based on a trigger and then you use something like PHP cURL to bring the page into the domain your working with at the moment you may be able to invoke a cookie from the other domain. This is pure theory though not something I have tested. The idea is since you own both domains its assumed you also have access to both hosting servers. So with that you need something on both ends to work with one another to do what you want, rather then hope for a one sided solution.
Reference: http://www.quirksmode.org/js/cookies.html
Let's say I have a page that refers to a .js file. In that file I have the following code that sets the value of a variable:
var foo;
function bar()
{
foo = //some value generated by some type of user input
}
bar();
Now I'd like to be able to navigate to another page that refers to the same script, and have this variable retain the value set by bar(). What's the best way to transport the value of this variable, assuming the script will be running anew once I arrive on the next page?
You can use cookies.
Cookies were originally invented by
Netscape to give 'memory' to web
servers and browsers. The HTTP
protocol, which arranges for the
transfer of web pages to your browser
and browser requests for pages to
servers, is state-less, which means
that once the server has sent a page
to a browser requesting it, it doesn't
remember a thing about it. So if you
come to the same web page a second,
third, hundredth or millionth time,
the server once again considers it the
very first time you ever came there.
This can be annoying in a number of
ways. The server cannot remember if
you identified yourself when you want
to access protected pages, it cannot
remember your user preferences, it
cannot remember anything. As soon as
personalization was invented, this
became a major problem.
Cookies were invented to solve this
problem. There are other ways to solve
it, but cookies are easy to maintain
and very versatile.
See: http://www.quirksmode.org/js/cookies.html
You can pass the value in the query string.
When the user navigate to the other page append the value to the query string and load it in the next.
Another option is jStorage. jStorage is probably better used for cached data and lossy user preferences (e.g. saved username in a login form), as it doesn't have full browser support (but IE6+ and most other common browsers support it) and cannot be relied upon (like cookies).
You can use YUI's Cookie Library http://developer.yahoo.com/yui/cookie/