WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
Coffee With Developers • Apr 19, 2026

Things You Don't Know About Cookies and How to Protect Them - Mohamed Shiralizadeh

Mohamed Shiralizadeh

Mohamed Shiralizadeh reveals why unencrypted cookies make your applications prime targets for credential theft. Master strict HTTP attributes to lock down session management and defeat modern CSRF attacks.

Pause
Mute Enter Fullscreen
#1 about 6 min

Understanding the lifecycle and fundamental mechanisms of browser cookies

Without built-in state mechanisms, applications utilize the set-cookie header to reliably store variables and seamlessly verify recurring user connections.

#2 about 5 min

Extracting stored cookie credentials from local sqlite databases

Physical installation access enables attackers to arbitrarily exfiltrate unencrypted session credentials via underlying browser database files.

#3 about 3 min

Securing cookie names and encrypting sensitive session values

Superficial encoding leaves data vulnerable, requiring robust encryption algorithms and secure name prefixes to protect sensitive session variables.

#4 about 5 min

Controlling cookie access across root domains and subdomains

Without explicit boundary configurations, managing the domain attribute actively safeguards systems by constraining access across various interconnected subdomains.

#5 about 3 min

Managing cookie lifespans and invalidating server-side sessions

While client-side time limits clear localized storage, backend session invalidation strictly neutralizes malicious attempts utilizing captured legacy cookies.

#6 about 5 min

Enforcing encrypted transmission with the secure cookie attribute

Permitting broad transmission exposes credentials, highlighting why the secure flag strictly enforces data transfer strictly over encrypted https protocols.

#7 about 5 min

Mitigating cross-site scripting risks using the httponly attribute

Unfettered frontend access enables widespread theft, forcing the httponly flag to reliably block automated javascript scraping techniques.

#8 about 6 min

Differentiating cross-origin requests from site boundaries for cookies

Distinguishing basic origins from actual site boundaries requires referencing the public suffix list to properly govern strict communication rules.

#9 about 5 min

Examining cross-site request vulnerabilities with samesite none

Disabling modern boundary restrictions recklessly exposes endpoints to targeted forgery while broadly facilitating unlimited third-party analytics tracking.

#10 about 4 min

Adopting samesite lax as the default browser security expectation

Mitigating the historical rise in deliberate request forgery relies entirely on modern browsers enforcing lax configurations as their baseline standard.

#11 about 8 min

Comparing samesite strict and lax for top-level navigations

Balancing stringent security with usability requires understanding how strict modes thoroughly block cookies while lax configurations safely accommodate authorized incoming links.

#12 about 5 min

Managing third-party tracking through browser privacy settings

Confronting invasive analytics engines requires directly blocking third-party interactions within native browser menus to override platform-level tracking integrations.

#13 about 3 min

Comparing local storage patterns with browser cookie security

Offloading proprietary sessions completely bypasses native web defenses, leaving unencrypted local storage arrays completely exposed to severe manipulation tactics.

#14 about 6 min

Identifying sophisticated supply chain attacks and simulated software vulnerabilities

Exploiting widespread developer trust allows threat actors to seamlessly distribute functional malicious toolkits using subtle open-source repository mistyping strategies.

#15 about 7 min

Prioritizing max-age over expires for http response optimization

Minimizing unnecessary network latency involves prioritizing compact max-age integers to significantly reduce request header payload bloat during high-volume operations.

Matching moments

3:22 min

Applying transport restrictions and cookie security flags

Thomas Konrad · LIVE

2:52 min

Overcoming historical web caching and privacy challenges

Thomas Steiner · Coffee With Developers

5:29 min

Blocking browser cookie theft and dangerous terminal commands

Luke Hinds · Coffee With Developers

4:56 min

Fixing cryptographic failures by enforcing encrypted transport

Christian Wenz Christian Wenz · World Congress 2026 Europe

3:05 min

Securing applications with HTTP response headers

Jakub Andrzejewski · World Congress 2023

3:48 min

Security defaults and preventing cross site request forgery

Daniel Hepper · LIVE

More from Coffee With Developers

Using Agents to Curate the Content You See Online - Dan Gish thumbnail
12:47
21 days ago

Using Agents to Curate the Content You See Online - Dan Gish

Dan Gish

AI Vector Search at Scale - Ewa Szyszka - Ewa Szyszka thumbnail
11:14
21 days ago

AI Vector Search at Scale - Ewa Szyszka - Ewa Szyszka

Ewa Szyszka

What is Cross-Origin Storage - Thomas Steiner thumbnail
34:51
21 days ago

What is Cross-Origin Storage - Thomas Steiner

Thomas Steiner

Women in AI - Nalini Garg thumbnail
42:19
22 days ago

Women in AI - Nalini Garg

Nalini Garg

Agents and People Dynamics in Shared Chats - Sam Liu thumbnail
37:41
29 days ago

Agents and People Dynamics in Shared Chats - Sam Liu

Sam Liu

Why Token Reduction Isn’t Cost Reduction - Dave Anderson & Sarel Weinberger, PhD. thumbnail
41:09
about 1 month ago

Why Token Reduction Isn’t Cost Reduction - Dave Anderson & Sarel Weinberger, PhD.

Dave Anderson, Sarel Weinberger, Phd

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 5

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Stage 1

The Era of Machine-Driven Defense is Here: Headless Security

Loris Degioanni

Founder & CTO of Sysdig

Loris Degioanni
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 16:50–17:20

Stage 5

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer at Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 7

Clean Rooms Demystified: Architecture and Patterns for Privacy-Safe Data Collaboration

Anurag Malik

Data Tech Lead @ Intuit

Anurag Malik

Related videos

Bulletproof Web Applications: The 2025 OWASP Top Ten thumbnail
25:29
World Congress 2026 Europe • 2 months ago

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

MFA? Game over! Watch your protection collapse – live thumbnail
28:30
World Congress 2026 Europe • 2 months ago

MFA? Game over! Watch your protection collapse – live

Christoph Menzel

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Going Beyond Passwords: The Future of User Authentication thumbnail
27:55
World Congress 2023 • almost 3 years ago

Going Beyond Passwords: The Future of User Authentication

Gift Egwuenu

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.