2

Details: For our test procedures, we want to read the cookies of a website, manipulate the cookie and read it again.

We want to test if this is possible at all to avoid a security gap.

We use for our test procedures:

Selenium - latest version Python - Latest version And several other Python packages.

Question: Can I use Selenium to read the cookies, write them back after manipulation?

  • Something like this? stackoverflow.com/questions/15058462/… – pavelsaman Jan 20 at 14:22
  • It goes that way, but only partially. I am also more concerned about a manipulation of the cookie, error message which I would like to have afterwards, but then as a positive test. So it's a bit different ;) – Mornon Jan 20 at 14:30
  • I'm a bit confused about what you want to achieve. But an answer to your question in the title is simply yes :) If you need a certain flow after you manipulate the cookies, well, you'd need to describe that a bit more, at least I don't fully get it from your current description. – pavelsaman Jan 20 at 16:23
1

Yes, you can retrieve the cookies for a domain, then delete and re-add cookies with different values with Selenium in Python. See the following examples:

https://selenium-python.readthedocs.io/navigating.html#cookies

# Go to the correct domain
driver.get("http://www.example.com")

# Now set the cookie. This one's valid for the entire domain
cookie = {‘name’ : ‘foo’, ‘value’ : ‘bar’}
driver.add_cookie(cookie)

# And now output all the available cookies for the current URL
driver.get_cookies()

https://chercher.tech/python/python-selenium-cookies

driver.delete_cookie("foo")
driver.delete_all_cookies()
|improve this answer|||||
2
+25

Even though you can do it using seleniums built-in cookie manager I wouldn't recommend doing so if you're looking for security gaps. The WebDriver acts with much higher privileges than an actual attack scenario would (just look at seleniums switch_to which basically circumvents the same-origin policy, something a real attacker would have a really hard time to do) and as far as I recall it will also not respect httpOnly cookie settings.

Using the javascript_executor and passing it JS to change the cookie value will probably yield more reliable results for your case.

def change_cookie(cookie_name, new_value):
    script = """
    function manipulate_cookie(cookie_name, new_value){
        var key_value_pairs = document.cookie.split(";")
        var cookies = {}
        for(kv_pair of key_value_pairs){
            cookies[kv_pair.split("=")[0]] = kv_pair.split("=")[1]
        }
        if(cookies[cookie_name])
            cookies[cookie_name] = new_value

        var new_cookies = []
        for(cookie in cookies){
            new_cookies.push(`${cookie}=${cookies[cookie]}`)
        }
        return  new_cookies.join(";")
    }document.cookie = manipulate_cookie(arguments[0], arguments[1])
    """
    driver.execute_script(script, cookie_name, new_value)

will change the cookie value using only browser accesible methods and a simple

def get_cookie(cookie_name):
script = """
    function get_cookie(cookie_name){
    var key_value_pairs = document.cookie.split(";")
    var cookies = {}
   for(kv_pair of key_value_pairs){
        cookies[kv_pair.split("=")[0].trim()] = kv_pair.split("=")[1]
    }
    return cookies[cookie_name]
}return get_cookie(arguments[0])
"""
return driver.execute_script(script, cookie_name) #Will return a string with the cookie value

will retrieve the data using the same constraints a not webdriver driven browser will have to respect.

The built-in methods for cookie manipulation are valuable if you need them to establish or pass sessions but they're not meant to test for actual browser behaviour because they are meant to allow for things you couldn't do natively.

|improve this answer|||||
1

I've never done with with Python, but, have a few times with C#. I know you won't be able to copy/paste this, but, will maybe help point you in the right direction

        string cookieNameString = _driver.Manage().Cookies.GetCookieNamed("actualCookieName").Value;
        cookieNameString = "my new cookie value";
        Cookie actualCookieName = new Cookie("actualCookieName", cookieNameString);
        _driver.Manage().Cookies.AddCookie(actualCookieName);
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.