labs

Our popular tags

XSS Frans Rosén Mathias Karlsson bug bounty Cross Site Scripting Chrome Hostile Subdomain takeover Ethical Hacking Slack postmessage PHP SQL Injection

Most Read Articles

How I made LastPass give me all your passwords Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token Slack bot token leakage exposing business critical information Chrome Extensions – AKA Total Absence of Privacy How Patreon got hacked – Publicly exposed Werkzeug Debugger

Analyze your website from a hacker’s perspective. Sign up for a Detectify free trial»

Stay on top of security - sign up for our newsletter

Receive monthly updates about the latest vulnerabilities, hacker attacks and security best practices.

Detectify Labs > Cookie fixation

CSP flaws: cookie fixation

2017.01.12 labsdetectify

TL;DR: CSP can’t block <meta http-equiv="Set-Cookie" content="a=b">. XSS vulnerability on a page with CSP can still be source for attacks that are based on writing cookies. Let’s take a look at some examples of cookie fixation issues.