Unit 4: Cookies and sessions · Lesson 1 of 6 · 18 min

How sessions work

HTTP forgets you between requests. A cookie reminds it.

mission

You are
The analyst reviewing the shop's sign-in.
Situation
Before testing sign-out and cookie flags, you need to see a session from the server's side and the client's side.
Goal
Sign in with the test account, keep the session in a cookie jar and use it.
Hand in
The session cookie's name and the request that proves you are signed in.

Sessions as a coat check

01

Read the test account

learner@web-lab
cat shop-account.txt
user=learner&password=lab-only-pass

you should see A form body: user and password, joined with &.

02

Sign in and watch the cookies arrive

learner@web-lab
curl -si -d @shop-account.txt http://127.0.0.1:8000/login | grep -iE '^(HTTP|location|set-cookie)'
HTTP/1.1 303 See Other
Location: /account
Set-Cookie: shop_session=7f3a9c2e41d8b6a5; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: theme=dark; Path=/; Max-Age=31536000
Set-Cookie: last_view=shop; Path=/

you should see 303 to /account and three Set-Cookie headers.

03

Keep them in a jar

-c writes cookies the server sets to a file, -b sends them back. The jar is curl's version of the browser's cookie store.

learner@web-lab
curl -s -o /dev/null -c jar.txt -d @shop-account.txt http://127.0.0.1:8000/login
grep 127.0.0.1 jar.txt | cut -f1,6,7
127.0.0.1	last_view	shop
127.0.0.1	theme	dark
#HttpOnly_127.0.0.1	shop_session	7f3a9c2e41d8b6a5

you should see One line per cookie. The #HttpOnly_ prefix marks cookies scripts may not read.

04

Use the session

learner@web-lab
curl -s -b jar.txt http://127.0.0.1:8000/account | grep Signed
<p>Signed in as learner.</p>
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8000/account
302

you should see With the jar you are signed in. Without it you get 302 to sign in.

defender tip Whoever holds the session value is signed in. Treat it like a password in your notes: never paste a live one into a ticket.

What a defender takes away

  1. 1A session is an ID the server hands out and the browser returns on every request.
  2. 2curl -c and -b let you hold a session in the terminal.
  3. 3Session values are credentials; protect them like passwords.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.