Cookie Crumbles - Unveiling Web Session Integrity Vulnerabilities

Cookie Crumbles - Unveiling Web Session Integrity Vulnerabilities

Explore the critical security implications of cookie integrity issues in this 28-minute Black Hat conference talk. Delve into the history of cookie vulnerabilities and examine the effectiveness of modern protection mechanisms like the updated RFC6265bis standard, cookie prefixes, and the SameSite attribute. Discover how seemingly robust security measures can be bypassed, leaving web applications exposed to session integrity attacks such as session fixation and cross-origin request forgery (CORF). Learn from experts Pedro Adão and Marco Squarcina as they uncover real-world vulnerabilities and provide insights into strengthening web session security.