(In-)Security of Cookies in HTTPS: Cookie Theft by Removing Cookie Flags

Hyunsoo Kwon, Hyunjae Nam, Sangtae Lee, Changhee Hahn, Junbeom Hur

Research output: Contribution to journalArticlepeer-review

6 Citations (Scopus)


HyperText Transfer Protocol (HTTP) cookies are widely used on the web to enhance communication efficiency between a client and a server by storing stateful information. However, cookies may contain private and sensitive information about users. Thus, in order to guarantee the security of cookies, most web browsers and servers support not only Transport Layer Security (TLS) but also other mechanisms such as HTTP Strict Transport Security and cookie flags. However, a recent study has shown that it is possible to circumvent cookie flags in HTTPS by exploiting a vulnerability in HTTP software that allows message truncation. In this paper, we propose a novel cookie hijacking attack called rotten~cookie which deactivates cookie flags even if they are protected by TLS by exploiting a weakness in HTTP in terms of integrity checks. According to our investigation, all major browsers ignore uninterpretable sections of the header of HTTP response messages and accept incorrect formats without any rejection. We demonstrate that, when combined with TLS or application vulnerabilities, this form of attack can obtain private cookies by removing cookie flags. Thus, the attacker can impersonate a legitimate user in the eyes of the server when cookies are used as an authentication token. We prove the practicality of our attack by demonstrating that our attack can lead five major web browsers to accept a cookie without any cookie flags. We thus present a mitigation strategy for the transport layer to preserve cookie security against our attack.

Original languageEnglish
Article number8820079
Pages (from-to)1204-1215
Number of pages12
JournalIEEE Transactions on Information Forensics and Security
Publication statusPublished - 2020

Bibliographical note

Publisher Copyright:
© 2005-2012 IEEE.


  • Cookie theft attack
  • hypertext transfer protocol

ASJC Scopus subject areas

  • Safety, Risk, Reliability and Quality
  • Computer Networks and Communications


Dive into the research topics of '(In-)Security of Cookies in HTTPS: Cookie Theft by Removing Cookie Flags'. Together they form a unique fingerprint.

Cite this