Php modify or remove 3rd party cookie

Question

0.00/5 (No votes)

See more:

So unfortunately someone is trying a cross script cookie attack to commit fraud on my site. I can see the header and all I think I need to do is change 3 things with the cookie they created (I have PHP v.7+)

My code to adjust the cookie

session_set_cookie_params( [
     'lifetime' => 0,
     'Max-Age' => 0,
     'samesite' => 'Strict',
 ] );

So I expire Max-Age and lifetime and change the samesite to Strict (from Lax). This page doesn't use cookies and I want to just unset it. But I didn't think it was possible and the attacker set that elsewhere.

I made a test program but I don't think this code works. What am I doing wrong and how can I change this malicious cookie or just destroy it.

Sample header (I cleaned this a bit because it was long)
====
{"date":"Tue, 28 Jul 2024 20:47:06 GMT","content-type":"text/html; charset=UTF-8","transfer-encoding":"chunked","connection":"close","x-powered-by":"PHP/8.3.9","cache-control":"no-cache, private","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval' 'unsafe-inline'","set-cookie":["applocale=xx; expires=Thu, 28 Aug 2024 20:47:04 GMT; Max-Age=2591998; path=/; secure; httponly; samesite=lax","XSRF-TOKEN=xx; expires=Tue, 28 Jul 2024 22:47:06 GMT; Max-Age=7200; path=/; secure;

What I have tried:

I wrote code to modify the cookie but I don't think this works.

Posted 30-Jul-24 8:04am

mcbain19

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Pete O'Hanlon · Answer 1 · 2024-07-30T22:03:00

Solution 1

For security reasons, you cannot manipulate third party cookies in PHP. When you think about it, that would be a bad thing because it would allow someone with less positive reasons than you doing some pretty malicious things. You would be much better off implementing XSS prevention in your code.

Posted 30-Jul-24 22:03pm

Pete O'Hanlon

Comments

mcbain19 31-Jul-24 13:46pm

Hmmm I see in the header setting samesite to strict and expiring is all under set-cookie value. But there has got be be a way to either disable cookies at the server (I don't use them for this site) or applying some update.