Scribd
Upload
89 views13 pages

Cookies and Frame Busting Techniques

Cookies are used to store state on a user's machine and add state to the otherwise stateless HTTP protocol. Frame busting techniques prevent a web page from loading within a frame to protect against attacks like displaying a login page within a frame. The document discusses cookies, cookie security policies, secure and HTTP-only cookies, frames, and frame busting techniques including checking if the window is at the top level to prevent loading within a frame.

Uploaded by

Harpreet Singh
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
89 views13 pages

Cookies and Frame Busting Techniques

Cookies are used to store state on a user's machine and add state to the otherwise stateless HTTP protocol. Frame busting techniques prevent a web page from loading within a frame to protect against attacks like displaying a login page within a frame. The document discusses cookies, cookie security policies, secure and HTTP-only cookies, frames, and frame busting techniques including checking if the window is at the top level to prevent loading within a frame.

Uploaded by

Harpreet Singh
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd

Module 5.

6: Cookies, Frames
and Frame Busting
COOKIES: CLIENT STATE

2
Cookies
Used to store state on users
POST
machine
Browser
Server
HTTP Header:
Set-cookie: NAME=VALUE ;
If expires=NULL: domain = (who can read) ;
this session only expires = (when expires) ;
secure = (only over SSL)

Browser POST Server


Cookie: NAME = VALUE

HTTP is stateless protocol; cookies add state


Cookie authentication
Browser Web Server Auth server
POST [Link]
Username & pwd Validate user

Set-cookie: auth=val auth=val


Store val

GET [Link]
[Link]
Cookie: auth=val Check val
auth=val
If YES, YES/NO
[Link]
Cookie Security Policy
Uses:
User authentication
Personalization
User tracking: e.g. Doubleclick (3rd party cookies)

Browser will store:


At most 20 cookies/site, 3 KB / cookie

Origin is the tuple <domain, path>


Can set cookies valid across a domain suffix
Secure Cookies
GET
Browser
Server
HTTP Header:
Set-cookie: NAME=VALUE ;
Secure=true

Provides confidentiality against network


attacker
Browser will only send cookie back over
HTTPS
but no integrity
httpOnly Cookies
GET
Browser
Server
HTTP Header:
Set-cookie: NAME=VALUE ;
httpOnly

Cookie sent over HTTP(s), but not accessible to scripts


cannot be read via [Link]
Helps prevent cookie theft via XSS
FRAMES AND FRAME
BUSTING
Frames
Embed HTML documents in other
<iframe name=myframe
documents
src=[Link]
This text is ignored by most
browsers.
</iframe>
Frame Busting
Goal: prevent web page from loading in a
frame
example: opening login page in a frame will display
correct passmark image

Frame busting:
if (top != self)
[Link] = [Link]
Better Frame Busting

Problem: Javascript OnUnload event


<body onUnload="javascript: cause_an_abort;)">

Try this instead:


if (top != self)
[Link] = [Link]
else { code of page here }
Summary
Http
Rendering content
Isolation
Communication
Navigation
Security User Interface
Cookies
Frames and frame busting
Lecture 5: Web Client
Security
Total 6 Modules on Web Client Security
Module 5.1: Web Security Landscape
Module 5.2: Web Security Definitions, Goals and
Threat Models
Module 5.3: HTTP & Content Rendering
Module 5.4: Browser Isolation
Module 5.5: Security Interface
Module 5.6: Cookies, Frames and Frame Busting

You might also like