This article is a part of our Web Security Knowledge Base (back to index)

Why Cookie Slack Detector can be dangerous

It means that for a series of GET requests to the same URI, each time dropping a different cookie, nothing changes in the response length. Cookies which don’t have the expected effect can reveal flaws in application logic. In the worst case, there may be areas on the website where authentication via session cookies or the content controlled by preference cookies are not actually enforced. This leaves the possibility of fingerprinting the application and preparing scenarios for further attacks.

How to fix Cookie Slack Detector

Verify if you are using session IDs and cookie-based authentication.

Check if all cookie preferences are used.

Ensure there are no unused information cookies.

Review all the areas reported to have issues with slack cookies.

How does ScanRepeat report Cookie Slack Detector

ScanRepeat checks one by one if cookies are used for rendering the page at a given URI, based on length in bytes of response compared to baseline request. It reports every occurrence of such a vulnerability providing the URL of the issue along with the slack cookie name.

Would you like to test your application now against this problem? Sign up for our free trial

Scan Your Web App Now
Scan your application
for 14 days for free

No credit card is required. No commitment.

Sign Up Free