Cookie - Security issues

Hey !!

What does cookie actually contain.

What information can we get from cookies.

List potential vulnerabilities that exist for the client if this cookie data were transmitted in plain text.

List potential vulnerabilities that exist for a server if a client were allowed to modify the contents of the local cookie file and it were transmitted to the server.

Let me know

Thanz

Official
documentation from Netscape about cookies

> What does cookie actually contain.
What ever you put in there. Arbitrary data, around 1-4 kb max.
Additionally: A time when it becomes invalid, an URL and a "ssl" flag.

> What information can we get from cookies.
See above

> List potential vulnerabilities that exist for the client if this cookie data were transmitted in plain text.
Not more and not less vulnerabilities than transmitting anything else unencrypted too.

> List potential vulnerabilities that exist for a server if a client were allowed to modify the contents of the local cookie file and it were transmitted to the server.
A client is allowed to modify its own cookies. A server side programmer must know this and never rely on cookies containing anything valid.
Vulns: None if you do it correctly.

... what's the deal with cookies? Is this some kind of school assignment?
They're nothing. At least nothing worth mentioning in a security context. They are only as secure as the programmer applying them, just like everything else in this world too.

M.

Hey

Thanz for the information