4 ms·

"Cookie forcing" is more commonly called "session fixation". You'll find far more about it if you search under that name.

• homakov 13y ago
  Not true, two pretty different techniques. Forcing is about dropping HTTP cookies to https using mitm Fixation is session riding
  • ef4 13y ago
    I disagree. The point in either case is to get a cookie of the attacker's choosing accepted as the session identifier for the privileged domain. But even if we consider them separate techniques, the mitigation strategy is identical anyway.
    • homakov 13y ago
      Yes mitigation is identical