4 ms·
The ability to reuse these extracted cookies is an exfiltration issue. The solution to exfiltration is ensuring the cookie is only valid from a specific client
by kevlened 3y ago
The ability to reuse these extracted cookies is an exfiltration issue. The solution to exfiltration is ensuring the cookie is only valid from a specific client (aka token binding).
Because token binding is just a signature, debugging isn’t crippled, because the content is still readable while the cookies in the HAR files stay safe.
We’ll likely see more session implementations using token binding soon. (probably not mTLS due to the UX)
- sanHACKING78YOU 3y ago[flagged]
- ec109685 3y agoHow would that work in practice to prevent this hijacking of session cookies from browser based apps?
- kevlened 3y agoThese systems work using pub/private keys, signing each outgoing request (much like traditional tls). If you were able to get the cookies, you’d be unable to use them from another browser unless you also extracted the private key.
- ec109685 3y agoYeah, I get the idea and it seems promising. But how would a company deploy a solution today using this technique?
- kevlened 3y agoWhile the TLS-based version was removed from Chrome [0], you can implement a less efficient (and slightly less secure) version in js. I created an example [1]. The gist is: 1. Client creates a key pair in js 2. Client sends pub key on initial auth 3. Server validates auth and attaches pub key to cookie 4. Client signs each request payload with a timestamp 5. Server validates signature and timestamp The security issue is in step 1. WebCrypto can generate non-extractable private keys and store them in indexeddb. However, this assumes no malicious code flips the “extractable” flag before the pair is generated. So this strategy is trust-on-first-use. [0] - https://chromestatus.com/feature/5097603234529280 https://chromestatus.com/feature/5097603234529280 [1] - https://github.com/kevlened/prevent-exfiltration/blob/main/index.mjs https://github.com/kevlened/prevent-exfiltration/blob/main/i...