COOKIEGUARD: Characterizing and Isolating the First-Party Cookie Jar
<|reference_start|>COOKIEGUARD: Characterizing and Isolating the First-Party Cookie Jar: As third-party cookies are going away, first-party cookies are increasingly being used for tracking. Prior research has shown that third-party scripts write (or \textit{ghost-write}) first-party cookies in the browser's cookie jar because they are included in the website's main frame. What is more is that a third-party script is able to access all first-party cookies, both the actual first-party cookies as well as the ghost-written first-party cookies by different third-party scripts. Existing isolation mechanisms in the web browser such as SOP and CSP are not designed to address this lack of isolation between first-party cookies written by different third-parties. We conduct a comprehensive analysis of cross-domain first-party cookie retrieval, exfiltration, and modification on top-10K websites. Most notably, we find 18\% and 4\% of the first-party cookies are exfiltrated and overwritten, respectively, by cross-domain third-party scripts. We propose \name to introduce isolation between first-party cookies set by different third-party scripts in the main frame. To this end, \name intercepts cookie get and set operations between third-party scripts and the browser's cookie jar to enforce strict isolation between first-party cookies set by different third-party domains. Our evaluation of \name shows that it effectively blocks all cross-domain cookie read/write operations to provide a fully isolated cookie jar. While it generally does not impact appearance, navigation, or other website functionality, the strict isolation policy disrupts Single Sign-On (SSO) on just 11\% of websites that rely on first-party cookies for session management. Our work demonstrates the feasibility of isolating first-party cookies.<|reference_end|>
@article{bahrami2024cookieguard:,
    title={COOKIEGUARD: Characterizing and Isolating the First-Party Cookie Jar},
    author={Pouneh Nikkhah Bahrami, Aurore Fass and Zubair Shafiq},
    journal={arXiv preprint arXiv:2406.05310},
    year={2024},
    archivePrefix={arXiv},
    eprint={2406.05310},
    primaryClass={cs.CR}
}