How to prevent cookie poisoning

Question

I save data in a cookie to authenticate users for the next login (remember me option). This data is encrypted and hashed.

But here's the problem:

Anyone can take this cookie and put it on another machine and it will work.

I heard that is called cookie poisoning

How do I overcome this?

Answer 1

Store the computer's IP address and/or hostname in the cookie (hashed) as well as your current scheme and validate that as well.

Answer 2

The threat you're describing is that an adversary will steal a user's cookie and use it to access that user's session. One way to prevent against this is to store IP addresses or Hostnames as Daniel A White mentions, although if that's not possible there is no 100% secure way to negotiate this.

Here are a couple other options that can secure against this kind of attack:

1. Use HTTPS for all session-based site traffic, and set your cookies to only transmit via HTTPS. If this is an option for you, this will prevent man-in-the-middle attacks.
2. Set an additional cookie with a random value that changes on every request. If the random value is used more than once, you know a hijacker has gained access, and you can destroy the session for safety.

Answer 3

You really can't stop it, but there are things you can do to make it harder and thereby less-attractive

1. Require the user to use https (443) the entire session. This will prevent any man-in-the-middle attacks from sniffing the cookie

2. Only allow one session to be active at a time. Once the second session shows up, the first session is invalidated.

3. Require the user to provide his old password when changing the password; this will prevent someone from hijacking the account and easily changing the password.

4. Have a very limited life for the session cookie - maybe a few hours.

That being said, since you have an open door into your system, you might want to ensure you're not storing any sensitive information that can be easily read by a user. So, for example, if a credit card or SSN is in the system, do not display it to the user.

Answer 4

but i see some sites like google preventing this ? and i read in wikipedia that i can eliminate Cookie poisoning using session identifier does any one have an idea how to do this.

Answer 5

Even an identifier could be used to hijack a session (which is used anyway to identify a unique session). The tip about asking for old password before assigning a new one is ok but if you support kind of "Lost my password" feature you need to ask for password everytime critical information is changed in the account (such as email).

What Google did: they allow you to browse the "places" (or computer) that logged onto your account (because you may use it at home, at work, etc.) and to "close" those connections. In the event a connection is unknown to you, you can "close" it (close the session) and change you password immediately to make sure the hijacker doesn't use the your old password (if password was known of it).