Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Cookies set to a blank value

Kevin | Last updated: Mar 08, 2018 03:16PM UTC

This issue occurs when running the scanner tool (I haven't tested on other tools), and if you have the setting to update the cookie jar from responses for the tool. If one of your responses contains an empty cookie (e.g. ASP.NET_SessionId=) then the cookie in the cookie jar is updated to be empty. I understand the site probably shouldn't be returning an empty cookie on response here, but it would be good if there was some logic that treated an empty cookie the same as if the cookie just wasn't returned (i.e. don't update the cookie jar). Thanks, Kevin.

PortSwigger Agent | Last updated: Mar 08, 2018 04:04PM UTC

Hi Kevin, Thanks for your message. We've had a think about this and while we understand your specific use case, we think this is a rare requirement. Most applications invalidate the session id when sending a header like that. If you case we'd recommend deselecting "Monitor the following tool's traffic to update the cookie jar" for Scanner. You could also write a simple extension which strips blank set-cookie headers. Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.