Topic: Is it possible for sites to read other sites' cookies?

Freecode !!4IKKtS9GG started this discussion 15 years ago #9,066

I understand cookies like passwords and such are often encoded, but would it be possible for a site to read in the information from another site?
ie: Let's say a spammer puts up ads on Facebook. He knows pretty much everyone who clicks will have a Facebook cookie with their login and password. Could that person then proceed to collect these cookies and use them to log into their owners' accounts?
I do not know a lot about network security, so I do not know if other security measures are typically enacted. Either way, though, I would imagine a simple PHP call may be able to retrieve information stored in a cookie unless cookies will only function for certain web addresses. Even then, the web address could probably be spoofed and incorrect information sent to the client computer - it would just be a matter some Javascript. I've seen that clients can spoof information sent to servers, so why not vice versa?
Of course, banking and credit card sites tend to have safeguards like IP checking and such, and an IP address or an authentication code would most likely not be stored on a cookie (I hope!), but most sites cannot afford to have a confirmation every time a user logs into a new network or computer.
TL;DR
See title. Potential security threat?

ltamake !!onnLC5KY8 joined in and replied with this 15 years ago, 53 minutes later[^] [v] #160,514

No. You shouldn't store usernames or passwords (especially passwords) in cookies anyway.

(Edited 26 seconds later.)

r04r joined in and replied with this 15 years ago, 4 hours later, 5 hours after the original post[^] [v] #160,576

You've got most of it wrong.

You are right that ads on websites can usually interact with the parent website, that's why they're carefully screened before including them. However when clicking one such ad and being sent to another site your browser won't sent the cookies with that, seeing as it's another domain. All cookies only function for certain domains.

There's another security feature implement to fix this entire problem, though. It's called httponly cookies. The cookies will only be sent to the server when making requests, and not be exposed to scripts running in the website.

Web addresses cannot be spoofed unless you have access to the client's machine or their LAN and it's not set up securely. If you have that, why would you want their cookies? :P As for why this is not possible, the client looks up in the DNS system what IP address a domain name points to (e.g. what IP address does minichan.org point to? It's 209.59.187.37), it then opens a request to that IP address and sends a few requests (headers) including what domain name it was looking for. The server has no say on what is displayed in the URL bar.

What kind of information have you seen clients "spoof"?

Also what you're most likely talking about are session cookies which contain just an identifier so the server knows who the person is. This identifier is unique every time they log in. Think of it as your social security number. You give them that number and they know a buttload about you.

tl;dr stop trying to hack facebook, you'll fail

(Edited 28 seconds later.)

Minichan