Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]

Cookies sent to different ports?

Subject: Cookies sent to different ports?
Date: Tue, 14 Dec 2004 15:24:14 -0500
Hello all,

  I have an observation about cookie behavior.  Scenario:

- a user goes to a web server running at http://host:12345/,
- host:12345 responds with a Set-Cookie: ... , PATH=/
- user/browser goes to http://host:54321/ (same host as above)

  Should the browser send the cookie with the GET of http://host:54321/?

My answer would be no, it should not since host:54321 is a different server (meaning process at least). However, I have checked this with both IE and Firefox and they happily send the cookie along.

Someone (thanks Matt) looked in to this for me a little and it turns out that this is required by the RFC, cookies are tied to host and protocol (HTTP or HTTPS, though I think this is only sometime true through use of the "secure" cookie tag), not to port. It would seem that this may have some implications in shared hosting environments, but usually those will be separate hostnames (even if they reside on the same IP). There are also cases where a team may have multiple "test" servers up on different posts of the same host, so this issue could come out there as well.

  Any thoughts?  Thanks.

Chuck

<Prev in Thread] Current Thread [Next in Thread>