HackBlue

Labs / Web and API security

Cookie flag simulator

Six Set-Cookie headers, six kinds of request. See which cookies the browser sends, which scripts can read, and which it rejects outright.

  • Interactive lab
  • Beginner
  • 5 steps
  • 0 of 5 solved

Goal

After sign-in, https://app.contoso.example/login answered with six Set-Cookie headers. Choose a request and see which cookies the browser attaches, then check which ones a script on the page could read.

Domain, Path, Secure, HttpOnly, and SameSite each remove a cookie from some situations. The reason column names the rule that decided.

Question

Request

Set-Cookie headers
Set-Cookie: session=9f2c41e8; Path=/; Secure; HttpOnly; SameSite=Lax
Set-Cookie: csrf=Qm4t7Zp1; Path=/; Secure; SameSite=Strict
Set-Cookie: theme=dark; Path=/
Set-Cookie: tracker=a81f; Path=/; SameSite=None
Set-Cookie: sso=ZXhhbXBsZQ; Domain=contoso.example; Path=/; Secure; HttpOnly; SameSite=Lax
Set-Cookie: admin_pref=compact; Path=/admin; Secure
GET https://app.contoso.example/api/profilefrom https://app.contoso.example
CookieSentWhy
sessionyesSame-site request that matches domain, path, and scheme.
csrfyesSame-site request that matches domain, path, and scheme.
themeyesSame-site request that matches domain, path, and scheme.
trackerrejectedSameSite=None requires Secure, so the browser drops this cookie.
ssoyesSame-site request that matches domain, path, and scheme.
admin_prefnoPath /api/profile is outside /admin.
Cookie: session=9f2c41e8; csrf=Qm4t7Zp1; theme=dark; sso=ZXhhbXBsZQ

Steps

  1. 01Which cookie does the browser refuse to store?

  2. 02The hidden form on evil.example posts to /transfer. Does the session cookie go with it?

  3. 03Following a link from news.example, which cookie stays behind that a same-site request would include?

  4. 04Which cookies can a script on https://app.contoso.example/ read through document.cookie?

  5. 05Which cookie also reaches blog.contoso.example?