WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
Coffee With Developers • Apr 19, 2026

Things You Don't Know About Cookies and How to Protect Them - Mohamed Shiralizadeh

Mohamed Shiralizadeh

Mohamed Shiralizadeh reveals why unencrypted cookies make your applications prime targets for credential theft. Master strict HTTP attributes to lock down session management and defeat modern CSRF attacks.

Pause
Mute Enter Fullscreen
#1 about 6 min

Understanding the lifecycle and fundamental mechanisms of browser cookies

Without built-in state mechanisms, applications utilize the set-cookie header to reliably store variables and seamlessly verify recurring user connections.

#2 about 5 min

Extracting stored cookie credentials from local sqlite databases

Physical installation access enables attackers to arbitrarily exfiltrate unencrypted session credentials via underlying browser database files.

#3 about 3 min

Securing cookie names and encrypting sensitive session values

Superficial encoding leaves data vulnerable, requiring robust encryption algorithms and secure name prefixes to protect sensitive session variables.

#4 about 5 min

Controlling cookie access across root domains and subdomains

Without explicit boundary configurations, managing the domain attribute actively safeguards systems by constraining access across various interconnected subdomains.

#5 about 3 min

Managing cookie lifespans and invalidating server-side sessions

While client-side time limits clear localized storage, backend session invalidation strictly neutralizes malicious attempts utilizing captured legacy cookies.

#6 about 5 min

Enforcing encrypted transmission with the secure cookie attribute

Permitting broad transmission exposes credentials, highlighting why the secure flag strictly enforces data transfer strictly over encrypted https protocols.

#7 about 5 min

Mitigating cross-site scripting risks using the httponly attribute

Unfettered frontend access enables widespread theft, forcing the httponly flag to reliably block automated javascript scraping techniques.

#8 about 6 min

Differentiating cross-origin requests from site boundaries for cookies

Distinguishing basic origins from actual site boundaries requires referencing the public suffix list to properly govern strict communication rules.

#9 about 5 min

Examining cross-site request vulnerabilities with samesite none

Disabling modern boundary restrictions recklessly exposes endpoints to targeted forgery while broadly facilitating unlimited third-party analytics tracking.

#10 about 4 min

Adopting samesite lax as the default browser security expectation

Mitigating the historical rise in deliberate request forgery relies entirely on modern browsers enforcing lax configurations as their baseline standard.

#11 about 8 min

Comparing samesite strict and lax for top-level navigations

Balancing stringent security with usability requires understanding how strict modes thoroughly block cookies while lax configurations safely accommodate authorized incoming links.

#12 about 5 min

Managing third-party tracking through browser privacy settings

Confronting invasive analytics engines requires directly blocking third-party interactions within native browser menus to override platform-level tracking integrations.

#13 about 3 min

Comparing local storage patterns with browser cookie security

Offloading proprietary sessions completely bypasses native web defenses, leaving unencrypted local storage arrays completely exposed to severe manipulation tactics.

#14 about 6 min

Identifying sophisticated supply chain attacks and simulated software vulnerabilities

Exploiting widespread developer trust allows threat actors to seamlessly distribute functional malicious toolkits using subtle open-source repository mistyping strategies.

#15 about 7 min

Prioritizing max-age over expires for http response optimization

Minimizing unnecessary network latency involves prioritizing compact max-age integers to significantly reduce request header payload bloat during high-volume operations.

Matching moments

3:22 min

Applying transport restrictions and cookie security flags

Thomas Konrad · LIVE

5:29 min

Blocking browser cookie theft and dangerous terminal commands

Luke Hinds · Coffee With Developers

4:56 min

Fixing cryptographic failures by enforcing encrypted transport

Christian Wenz Christian Wenz · WWC Europe 2026

3:05 min

Securing applications with HTTP response headers

Jakub Andrzejewski · WWC 2023

3:48 min

Security defaults and preventing cross site request forgery

Daniel Hepper · LIVE

2:57 min

Navigating malicious compliance in GDPR cookie banner implementations

Chris Heilmann +2 · LIVE

More from Coffee With Developers

What to Do About Hackathons in the Time of Agents - Mike Swift thumbnail
46:03
9 days ago

What to Do About Hackathons in the Time of Agents - Mike Swift

Mike Swift

Moving from Playing with AI to Implementing AI - Lee Stott thumbnail
18:43
13 days ago

Moving from Playing with AI to Implementing AI - Lee Stott

Lee Stott

Evals vs. Evil - AI and Package Security - Laurie Voss thumbnail
16:57
22 days ago

Evals vs. Evil - AI and Package Security - Laurie Voss

Laurie Voss

Burning Satellites, Talking Plants and Agents Hiring Each Other - Fake or News with Matt Zeunert thumbnail
4:57
27 days ago

Burning Satellites, Talking Plants and Agents Hiring Each Other - Fake or News with Matt Zeunert

Matt Zeunert

Web Scraping, AI Agents, and the Future of Open Source - Kevin Lewis (Apify) thumbnail
40:29
about 2 months ago

Web Scraping, AI Agents, and the Future of Open Source - Kevin Lewis (Apify)

Making Teaching Code Less Academic and More Market-Ready - Peter Ruppel thumbnail
32:22
about 2 months ago

Making Teaching Code Less Academic and More Market-Ready - Peter Ruppel

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer @ Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

Small LLM in your Browser: Huge Opportunities for Web Applications

Daniel Ostrovsky

UI/UX Architect at Payoneer | AI Architect | Full Cycle Development Expert | Public Speaker | Open Source Contributor |

Daniel Ostrovsky
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

Related videos

Bulletproof Web Applications: The 2025 OWASP Top Ten thumbnail
25:29
WWC Europe 2026 • about 1 month ago

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

101 Typical Security Pitfalls thumbnail
28:41
WWC 2022 • about 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

MFA? Game over! Watch your protection collapse – live thumbnail
28:30
WWC Europe 2026 • about 1 month ago

MFA? Game over! Watch your protection collapse – live

Christoph Menzel

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 5 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Going Beyond Passwords: The Future of User Authentication thumbnail
27:55
WWC 2023 • almost 3 years ago

Going Beyond Passwords: The Future of User Authentication

Gift Egwuenu

Software Security 101: Secure Coding Basics thumbnail
1:58:48
WWC 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.