A cookie is a small file with information about the user that is stored by a web server on the hard drive and later used by a web browser when requesting information from the server. Typically, this text file contains the user's ID, preferences, the cookie's expiration date, and more. All of this helps to provide faster and more convenient access when revisiting a website.
Cookies differ from each other and serve various functions.
There are also first-party cookies and third-party cookies.
First-party cookies are directly stored by the website visited by the user and can include language preferences or items added to a shopping cart in case of E-Commerce testing. These cookies are sometimes referred to as session cookies.
Third-party cookies are set by a different resource than the website the user is on and are often used to track user actions and display relevant advertisements on web pages based on the collected information. Third-party cookies are commonly used by Social networks, marketers, and advertisers. These cookies can also be persistent.
Flash cookies are persistent cookies that remain on a PC even after all other cookie files have been deleted, for example, through a web browser.
Secure cookies are a type of cookie that is transmitted only via HTTPS. When the «secure» attribute is set, these cookies are not in plain text, making it difficult for third parties or resources to intercept them.
HTTP-only cookies have a tag added to the cookie file to prevent data retrieval by client-side scripts. Only the corresponding server has access to this file.
Supercookies are cookie files that are often used by malicious actors to gain access to cookies from almost any website. They are blocked by most browsers, so they are relatively less harmful.
As already mentioned above, these files are stored on the user's hard drive as text files, and the storage location varies for each browser.
Here is how you can find cookie storage in Windows 10 for some popular browsers:
You can access cookie files by entering the following path in the file explorer's address bar: C:\Users\Your_User_Name\AppData\Local\Google\Chrome\User Data\Default, where «Your_User_Name» is your operating system account name.
Replace «Your_User_Name» with your Windows 10 account name and enter the following path: C:\Users\Your_User_Name\AppData\Roaming\Mozilla\Firefox\Profiles .
Inside the folder, you'll find files with random characters followed by «default-release». The cookie files will be stored in a file named cookies.sqlite. You can also view cookies within the browser's settings by selecting «Privacy and Security» and clicking «Manage Data» under «Cookies and Site Data». You can delete cookie files if needed by clicking «Clear Data» in this section.
Now that you know what cookies are, their types, and where to find them, the question remains: what exactly needs to be tested? The main methods for testing cookie files consist of the following steps:
Disabling
The first thing to check is how the website reacts to the disabling of cookies. Most core functions typically won't work correctly after this. Therefore, it is necessary for the website to display informative messages to the user. Before testing, you should delete all previously created cookies and close all open browsers. You can disable cookies in the browser settings under «Privacy and Security» > «Cookies and other site data».
Editing
If a file stores authentication data, you need to ensure that by editing the file with valid data, the user should not be able to access another existing account.
Deleting
Similar to the first point, the website should display informative messages instead of simply blocking core functions. The difference here is that you will need to manually delete cookies instead of disabling them in the browser. It's important to remember that when you delete cookies, all saved settings are deleted and logouts from accounts occur.
In Chrome, you can delete cookie files as follows:
Damaging
Editing with forged data involves manually editing a cookie file, and replacing the data with any invalid values. This method is used to compromise a website by gaining information from the domain.
Encryption
Confidential data in cookie files, such as login and password, should be encrypted on the server side to prevent anyone from reading them. Encryption should be verified before sending data to the local computer.
Additionally, the following supplementary checks are equally important:
Behavior in Different Browsers
Verify the creation of cookies in all supported browsers. The data inside the file should be stored correctly. It's worth noting that one browser cannot read the cookie files of another browser.
Excessive Use of Cookie Files
Frequent requests for files can lead to a drop in website traffic and have serious consequences.
File Access Testing
If a cookie file was created by one website, it cannot be used by any other.
We recommend considering several useful extensions that come in handy during cookie file testing:
Cookie AutoDelete - helps delete cookie files from closed tabs. This extension includes a feature to view the number of cookie files for a site and create a whitelist.
EditThisCookie is the most popular extension. It has functions for deleting, editing, creating cookie files, finding them, and blocking them.
Privacy Badger. Invisible trackers from advertising companies should be blocked by the browser, but in case it doesn't do so, using Privacy Badger can be helpful. This extension has the ability to block spyware ads that track cookie files. It distinguishes three main states:
Disconnect - blocks third-party connections when visiting a website, including invisible sites that track user activity. Page loading speed typically improves after such blocking.
Ghostery - blocks ads and third-party tracking on visited websites.
Adblock Plus not only blocks ads but also has a built-in blacklist that immediately filters out respective websites. There is also a function to whitelist websites.
In conclusion, it is clear that cookie files can serve both as a useful element to facilitate the user's experience and store necessary personal information for quick access to a website, as well as a harmful tool for hackers that can be used for malicious purposes. Testing cookie files helps ensure that all data is stored correctly and that measures have been taken to prevent theft or unauthorized use of this data by third parties.
