we are experiencing in our application in real time. To describe this in details, 

User1 logged the application in device A , user2 gathered information from device A using cookies editor. Now user2 logged the application in device B with his credentials and using cookies editor he changed the cookies details  and refreshed. Now in device B user2 able to login the application with user1 credentials without login page.

Please help me on this scenario.

Hi Ekadeep,

That seems like a bad vulnerability. Please contact OutSystems Support for help.

Okay Thanks for replying

Hi Ekadeep,

I've also talked with an OutSystems security expert, and they said that cookie stealing is a vulnerability for any website, and not specifically OS-related. You should always prevent stealing of cookies. But to steal a cookie, you must have access to another user's user directories on Windows, something that a user shouldn't have. Also, users should log off when they're no longer using the application, the session time-out shouldn't be too high, and you could enforce a policy on the browser that session cookies are deleted when the browser is closed.

So the only possible way to steal someone's cookies is when:

• Alice logs on to the application on a computer, then locks and leaves the computer;
• Bob logs in to the same computer, and has administrator rights to access Alice's user directories;
• Bob copies Alice's cookies to his own user directory, and has now stolen Alice's session.

Of course, for this to work, already a number of questionable things have happened, in particularly Bob having access to Alice's cookies in the first place.

Thanks very much for going more into the issue and to find a solution, the scenario you explained is almost matching with my issue . As you mentioned above to prevent the stealing of cookies, how could I achieve this. It would be more helpful for me if you tell me the way to block stealing the cookies.

Cordial thanks once again.

Regards,

Ekadeep K

Well, I think I did. In order to prevent stealing the cookies, you must make sure that users that share a computer are not allowed to access each other's user directories. That's something that the IT department should fix.

Sure , will make few learning sessions for the application users to protect their security related activities :p .

Thanks very much Kilian for pitching into my issues, and trying to close the issue.

You're most welcome. If you think one of my answers gave you a good answer to your question, please mark it as solution, thanks!