The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Cookie Path Restrictions

When the application residing at 

/apps/secure/foo-app/index.jsp

sets a

cookie, the browser will by default resubmit the cookie in all subsequent

requests to the path 

/apps/secure/foo-app/

, and also to any subdirectories. It

will not submit the cookie to the parent directory or to any other directory

paths that exist on the server.

As with domain-based restrictions on cookie scope, a server can override

this default behavior by including a 

path

attribute in the 

Set-cookie

instruc-

tion. For example, if the application returns the following HTTP header:

Set-cookie: sessionId=187ab023e09c00a881a; path=/apps/;

the browser will then resubmit this cookie to all subdirectories of the 

/apps/

path.

N OT E