# 你能偷走 Token 吗？

**URL:** <https://meta.discourse.org/t/can-you-steal-the-token/30263>\
**Category:** Support\
**Created:** [2015年六月21日 01:02 UTC](https://meta.discourse.org/t/can-you-steal-the-token/30263 "2015-06-21T01:02:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nahtnam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nahtnam/32/122073_2.png) [@nahtnam](https://meta.discourse.org/u/nahtnam)\
**Post date:** [2015年六月21日 01:02 UTC](https://meta.discourse.org/t/can-you-steal-the-token/30263/1 "2015-06-21T01:02:16Z")

</div>

Hey!

Just wondering, if someone is able to convince another person to go into chrome inspector and send them the text of the cookie `_t`:

![](https://global.discourse-cdn.com/meta/original/4X/f/e/d/fed19fb53f88101865a72bedabae0078d535125c.png)  
would the person be able to login and steal the account?

Thanks.

---

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [2015年六月21日 01:08 UTC](https://meta.discourse.org/t/can-you-steal-the-token/30263/2 "2015-06-21T01:08:51Z")

</div>

Yes, that will work on any website, too. Your cookie determines who you are. The cookie token can be cycled every (n) minutes so the window may be small depending on the website.

Gmail will often warn if it sees you logging in suddenly from a very different IP.

---

<div class="post-metadata">

**Author:** ![nahtnam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nahtnam/32/122073_2.png) [@nahtnam](https://meta.discourse.org/u/nahtnam)\
**Post date:** [2015年六月21日 01:16 UTC](https://meta.discourse.org/t/can-you-steal-the-token/30263/3 "2015-06-21T01:16:21Z")

</div>

For most sites the cookies are usually encrypted. Rails has something like this to prevent it: `cookies.signed[:user_id] = current_user.id`. I understand for ember, you have to leave the token in plain-text. Dont you think its a bit unsafe?

---

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [2015年六月21日 01:36 UTC](https://meta.discourse.org/t/can-you-steal-the-token/30263/4 "2015-06-21T01:36:06Z")

</div>

I don’t think you understand the mechanics. If you hold the cookie you are that user. It has nothing to do with the contents of the cookie. See

> **[Breaking the Web’s Cookie Jar](https://blog.codinghorror.com/breaking-the-webs-cookie-jar/)**
>
> The Firefox add-in Firesheep caused quite an uproar a few weeks ago, and justifiably so. Here’s how it works:
> 
> \* Connect to a public, unencrypted WiFi network. In other words, a WiFi network that doesn’t require a password before you can connect to...

---

<div class="post-metadata">

**Author:** ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)\
**Post date:** [2024年六月8日 12:46 UTC](https://meta.discourse.org/t/can-you-steal-the-token/30263/5 "2024-06-08T12:46:06Z")

</div>

此主题已在 3275 天后自动关闭。不再允许回复。