https://github.com/atomantic/canhazcookie
🍪 Test engine for cookie behaviors, using Node.js. Primarily building to validate Safari behavioral assumptions.
https://github.com/atomantic/canhazcookie
Last synced: 4 months ago
JSON representation
🍪 Test engine for cookie behaviors, using Node.js. Primarily building to validate Safari behavioral assumptions.
- Host: GitHub
- URL: https://github.com/atomantic/canhazcookie
- Owner: atomantic
- License: mit
- Created: 2015-04-03T17:02:57.000Z (about 11 years ago)
- Default Branch: master
- Last Pushed: 2024-05-19T17:03:35.000Z (about 2 years ago)
- Last Synced: 2025-03-06T06:31:48.919Z (over 1 year ago)
- Language: Shell
- Homepage:
- Size: 64.5 KB
- Stars: 1
- Watchers: 3
- Forks: 1
- Open Issues: 26
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# Can Haz Cookie?
This is a node.js testing platform for validating assumptions on undocumented cookie security modeling on various browsers. Specifically built to test the concept of a user-initiated click action spawning and popup, thereby marking that domain (b.com) as a trusted 1st party of the main window domain (a.com) for the purpose of reading/writing cookies.
## Dev Setup
```
echo "127.0.0.1 a.com b.com sso.com" >> /etc/hosts
# if you have cisco anyconnect VPN client, it maintains another /etc/hosts.ac file that will periodically overwrite
# your /etc/hosts
echo "127.0.0.1 a.com b.com sso.com" >> /etc/hosts.ac
```
If you don't yet have node, npm, etc, you can run `dev init` -- this will prompt you to install my [.dotfiles project](https://github.com/atomantic/dotfiles), which contains a lot of OSX developer scaffolding (apps and configs).
## Start the App
`gulp` will run the app and auto-load `a.com:1337`
From there, you can manually navigate to `b.com:1337`, `sso.com:1337`
## Testing
1. Notice on a.com:1337 that the iframe does not have a token_sso value.
2. Notice on b.com:1337 that the iframe does not have a token_sso value.
3. Click the login link on a.com
4. Reload b.com:1337
5. Notice that now, the cookies can be set and read.
## Automation
comming soon via `npm test` / `gulp test`
The test sequence we would like to run is this:
