Title http://www.cse.msu.edu/~alexliu/publications/Cookie/cookie.pdf
Abstract
Cookies are the primary means for web applications
to authenticate HTTP requests and to maintain client
states. Many web applications (such as electronic commerce)
demand a secure cookie protocol. Such a protocol
needs to provide the following four services: authentication,
confidentiality, integrity and anti-replay.
Several secure cookie protocols have been proposed in
previous literature; however, none of them are completely
satisfactory. In this paper, we propose a secure
cookie protocol that is effective, efficient, and easy to
deploy. In terms of effectiveness, our protocol provides
all of the above four security services. In terms of ef-
ficiency, our protocol does not involve any database
lookup or public key cryptography. In terms of deployability,
our protocol can be easily deployed on an existing
web server, and it does not require any change to
the Internet cookie specification. We implemented our
secure cookie protocol using PHP, and the experimental
results show that our protocol is very efficient.
1. Introduction
The widely used HTTP (Hypertext Transfer Protocol)
works in a request-response fashion. First, a client
sends a request (which either asks for a file or invokes
a program) to a server. Second, the server processes
the request and sends back a response to the client.
After this, the connection between the client and the
server is dropped and forgotten. HTTP is stateless in
that an HTTP server treats each request independently
of any previous requests. However, many web applications
built on top of HTTP need to be stateful. For example,
most online shopping applications need to keep
track of the shopping carts of their clients.
1 Alex X. Liu is the corresponding author of this paper
Web applications often use cookies to maintain
state. A cookie is a piece of information that
records the state of a client. When a server needs to remember
some state information for a client, the server
creates a cookie that contains the state information
and sends the cookie to the client. The client then
stores the cookie either in memory or on a hard disk.
The client later attaches the cookie to every subsequent
request to the server.
Many web applications (such as electronic commerce)
demand a secure cookie protocol. A secure
cookie protocol that runs between a client and a server
needs to provide the following four services: authentication,
confidentiality, integrity and anti-replay.
1. Authentication: A secure cookie protocol should
allow the server to verify that the client has been
authenticated within a certain time period. Moreover,
any client should not be able to forge a valid
cookie.
In secure web applications, a typical session
between a client and a server consists of two
phases. The first phase is called the login phase and
the second phase is called the subsequent-requests
phase.
Login Phase: In this phase, the client and the
server mutually authenticate each other. On one
hand, the client authenticates the server using the
server’s PKI (Public Key Infrastructure) Certifi-
cate after he establishes an SSL (Secure Sockets
Layer) connection with the server. On the other
hand, the server authenticates the client using the
client’s user name and password, and sends a secure
cookie (which is also called an “authentication
token” or an “authenticator” in previous literature)
to the client.
Subsequent-requests Phase: In this phase, the
client sends the secure cookie along with every request
to the server; the server verifies whether the
cookie is valid, and if it is, services the request.
2. Confidentiality: The contents of a secure cookie
is intended only for the server to read. There are
two levels of confidentiality that a secure cookie
protocol may achieve: low-level confidentiality and
high-level confidentiality.
(a) Low-level Confidentiality: A secure cookie
protocol with low-level confidentiality prevents
any parties except the server and the
client from reading the contents of a cookie.
To achieve low-level confidentiality, a secure
cookie protocol usually runs on top of
SSL. Note that SSL encrypts every message
between the client and the server using
a session key that only the client and
the server know. In this paper, we assume
that any secure cookie protocol runs
on top of SSL.
(b) High-level Confidentiality: A secure cookie
protocol with high-level confidentiality prevents
any parties except the server from reading
the sensitive information within a cookie
that the server does not want to reveal to the
client [8]. For example, the cookie’s contents
may contain some client information such as
their internal rating or credit score, which the
server may not want the client to be aware of.
Different web applications may require different
levels of confidentiality. Therefore, a secure cookie
protocol should be able to support either low-level
confidentiality or high-level confidentiality configurations.
3. Integrity: A secure cookie protocol should allow
a server to detect whether a cookie has been modified.
4. Anti-replay: In the case that an attacker replays
a stolen cookie, a secure cookie protocol should be
able to detect that the cookie is invalid. Otherwise,
the attacker would be authenticated as the
client that the replayed cookie was issued to.
In designing a secure cookie protocol, besides the
above security requirements, we also need to consider
the issues of efficiency and deployability. As for effi-
ciency concerns, a secure cookie protocol should avoid
requiring a server to do database lookups in verifying
a cookie, and should avoid public key cryptography.
Note that database lookups dramatically slow down
the speed that a server takes to verify a cookie. As for
deployability concerns, a secure cookie protocol should
avoid requiring a client to possess a public key and a
private key, which is currently impractical to assume.
Several cookie protocols have been proposed [2, 5,
8, 10]; however, none of these protocols are completely
satisfactory. The cookie protocol in [5] has three weaknesses:
it does not have a mechanism for providing
high-level confidentiality, it is vulnerable to cookie replay
attacks, and its mechanism for defending against
volume attacks is inefficient and non-scalable. The
three authentication mechanisms of the cookie protocol
in [8] are either ineffective or difficult to deploy. The
cookie protocols in [2] and [10] are inefficient because
they require database lookups in verifying a cookie.
In this paper, we propose a secure cookie protocol
that is effective, efficient, and easy to deploy. In terms
of effectiveness, our secure cookie protocol provides all
of the above four security services. In terms of effi-
ciency, our secure cookie protocol does not involve any
database lookup or public key cryptography. In terms
of deployability, our secure cookie protocol can be easily
deployed on an existing web server, and it does not
require any change to the current Internet cookie specification
[7].
The rest of this paper proceeds as follows. In Section
2, we present our secure cookie protocol in detail.
In Section 3, we discuss the implementation of our secure
cookie protocol and its performance. In Section 4,
we review and examine existing cookie protocols. We
give concluding remarks in Section 5.
2. Secure Cookie Protocol
The state of the art of secure cookie protocols is the
one presented by Fu et al. in [5]. In this section, we first
examine this protocol, which we refer as Fu’s cookie protocol.
We show that this protocol has three major problems,
and we give a solution to each of them. Finally,
we present our secure cookie protocol. The notations
used in this section are listed in the following table.
| Concatenation
HMAC (m, k) Keyed-Hash Message Authentication
Code of message m using key k
sk Server Key
(m)k Encryption of message m using key k
Table 1: Notations
The keyed-hash message authentication codes used
in this paper are assumed to be verifiable and nonmalleable:
given a message m and a key k, it is computationally
cheap to compute HMAC (m, k); however,
given HMAC (m, k), it is computationally infeasible
to compute the message m and the key k. Examples
of such keyed-hash message authentication codes are
HMAC-MD5 and HMAC-SHA1 [1, 4, 6, 9].
The server key (i.e., sk) of a server is a secret key
that only the server knows.
( user name|expiration time|data|session key, k)
where k=HMAC(user name|expiration time, sk)
Figure 2. Our Secure Cookie Protocol
服务器端cookie和客户端cookie之间有什么区别？ - 问答 - 云+社区 - 腾讯云 https://cloud.tencent.com/developer/ask/91330
HTTP cookie - Wikipedia https://en.wikipedia.org/wiki/HTTP_cookie#HttpOnly_cookie
Cookies are set using the Set-Cookie HTTP header, sent in an HTTP response from the web server. This header instructs the web browser to store the cookie and send it back in future requests to the server (the browser will ignore this header if it does not support cookies or has disabled cookies).
As an example, the browser sends its first request for the homepage of the www.example.org website:
GET /index.html HTTP/1.1
Host: www.example.org
…
The server responds with two Set-Cookie headers:
HTTP/1.0 200 OK
Content-type: text/html
Set-Cookie: theme=light
Set-Cookie: sessionToken=abc123; Expires=Wed, 09 Jun 2021 10:18:14 GMT
…
The server's HTTP response contains the contents of the website's homepage. But it also instructs the browser to set two cookies. The first, "theme", is considered to be a session cookie since it does not have an Expires or Max-Age attribute. Session cookies are intended to be deleted by the browser when the browser closes. The second, "sessionToken", is considered to be a persistent cookie since it contains an Expires attribute, which instructs the browser to delete the cookie at a specific date and time.
Next, the browser sends another request to visit the spec.html page on the website. This request contains a Cookie HTTP header, which contains the two cookies that the server instructed the browser to set:
GET /spec.html HTTP/1.1
Host: www.example.org
Cookie: theme=light; sessionToken=abc123
…
This way, the server knows that this request is related to the previous one. The server would answer by sending the requested page, possibly including more Set-Cookie headers in the response in order to add new cookies, modify existing cookies, or delete cookies.
The value of a cookie can be modified by the server by including a Set-Cookie header in response to a page request. The browser then replaces the old value with the new value.
The value of a cookie may consist of any printable ASCII character (! through ~, Unicode u0021 through u007E) excluding , and ; and whitespace characters. The name of a cookie excludes the same characters, as well as =, since that is the delimiter between the name and value. The cookie standard RFC 2965 is more restrictive but not implemented by browsers.
The term "cookie crumb" is sometimes used to refer to a cookie's name–value pair.[34]
Cookies can also be set by scripting languages such as JavaScript that run within the browser. In JavaScript, the object document.cookie is used for this purpose. For example, the instruction document.cookie = "temperature=20" creates a cookie of name "temperature" and value "20".[35]
A session cookie, also known as an in-memory cookie, transient cookie or non-persistent cookie, exists only in temporary memory while the user navigates the website.[18] Web browsers normally delete session cookies when the user closes the browser.[19] Unlike other cookies, session cookies do not have an expiration date assigned to them, which is how the browser knows to treat them as session cookies.
Instead of expiring when the web browser is closed as session cookies do, a persistent cookie expires at a specific date or after a specific length of time. This means that, for the cookie's entire lifespan (which can be as long or as short as its creators want), its information will be transmitted to the server every time the user visits the website that it belongs to, or every time the user views a resource belonging to that website from another website (such as an advertisement).
For this reason, persistent cookies are sometimes referred to as tracking cookies because they can be used by advertisers to record information about a user's web browsing habits over an extended period of time. However, they are also used for "legitimate" reasons (such as keeping users logged into their accounts on websites, to avoid re-entering login credentials at every visit).
These cookies are however reset if the expiration time is reached or the user manually deletes the cookie.
A secure cookie can only be transmitted over an encrypted connection (i.e. HTTPS). They cannot be transmitted over unencrypted connections (i.e. HTTP). This makes the cookie less likely to be exposed to cookie theft via eavesdropping. A cookie is made secure by adding the Secure flag to the cookie.
An http-only cookie cannot be accessed by client-side APIs, such as JavaScript. This restriction eliminates the threat of cookie theft via cross-site scripting (XSS). However, the cookie remains vulnerable to cross-site tracing (XST) and cross-site request forgery (XSRF) attacks. A cookie is given this characteristic by adding the HttpOnly flag to the cookie.
In 2016 Google Chrome version 51 introduced[20] a new kind of cookie, the same-site cookie, which can only be sent in requests originating from the same origin as the target domain. This restriction mitigates attacks such as cross-site request forgery (XSRF).[21] A cookie is given this characteristic by setting the SameSite flag to Strict or Lax.[22]
Normally, a cookie's domain attribute will match the domain that is shown in the web browser's address bar. This is called a first-party cookie. A third-party cookie, however, belongs to a domain different from the one shown in the address bar. This sort of cookie typically appears when web pages feature content from external websites, such as banner advertisements. This opens up the potential for tracking the user's browsing history and is often used by advertisers in an effort to serve relevant advertisements to each user.
As an example, suppose a user visits www.example.org. This website contains an advertisement from ad.foxytracking.com, which, when downloaded, sets a cookie belonging to the advertisement's domain (ad.foxytracking.com). Then, the user visits another website, www.foo.com, which also contains an advertisement from ad.foxytracking.com and sets a cookie belonging to that domain (ad.foxytracking.com). Eventually, both of these cookies will be sent to the advertiser when loading their advertisements or visiting their website. The advertiser can then use these cookies to build up a browsing history of the user across all the websites that have ads from this advertiser.
As of 2014, some websites were setting cookies readable for over 100 third-party domains.[23] On average, a single website was setting 10 cookies, with a maximum number of cookies (first- and third-party) reaching over 800.[24]
Most modern web browsers contain privacy settings that can block third-party cookies.
A supercookie is a cookie with an origin of a top-level domain (such as .com) or a public suffix (such as .co.uk). Ordinary cookies, by contrast, have an origin of a specific domain name, such as example.com.
Supercookies can be a potential security concern and are therefore often blocked by web browsers. If unblocked by the browser, an attacker in control of a malicious website could set a supercookie and potentially disrupt or impersonate legitimate user requests to another website that shares the same top-level domain or public suffix as the malicious website. For example, a supercookie with an origin of .com, could maliciously affect a request made to example.com, even if the cookie did not originate from example.com. This can be used to fake logins or change user information.
The Public Suffix List[25] helps to mitigate the risk that supercookies pose. The Public Suffix List is a cross-vendor initiative that aims to provide an accurate and up-to-date list of domain name suffixes. Older versions of browsers may not have an up-to-date list, and will therefore be vulnerable to supercookies from certain domains.
Other uses
The term "supercookie" is sometimes used for tracking technologies that do not rely on HTTP cookies. Two such "supercookie" mechanisms were found on Microsoft websites in August 2011: cookie syncing that respawned MUID (machine unique identifier) cookies, and ETag cookies.[26] Due to media attention, Microsoft later disabled this code.[27]
A zombie cookie is a cookie that is automatically recreated after being deleted. This is accomplished by storing the cookie's content in multiple locations, such as Flash Local shared object, HTML5 Web storage, and other client-side and even server-side locations. When the cookie's absence is detected,[clarification needed] the cookie is recreated[clarification needed] using the data stored in these locations.
统称为cookie；
服务端生成的cookie，又名session，会话，标识服务端请求者的身份，返回给服务端请求者；
可以通过js代码，在浏览器端、小程序端，生成的cookie，可用于页面间、组件间进行key-val访问、取值、修改值；
配置服务器Cookie_最佳实践_扩展阅读_负载均衡-阿里云 https://help.aliyun.com/document_detail/27704.html