✳flâneur — a map of the web's best reading

Catching Compromised Cookies - Slack Engineering

slack.engineering · 2,449 words · saved by 1 readers

Slack uses cookies to track session states for users on slack.com and the Slack Desktop app. The ever-present cookie banners have made cookies mainstream, but as a quick refresher, cookies are a little piece of client-side state associated with a website that is sent up to the web server on every request. Websites use this piece of information to inject state into the inherently stateless protocol of HTTP. At Slack, that means every time you sign into a workspace, your cookie (which we call the session cookie) is updated to reflect this. Since session cookies are frequently used to uniquely identify users in applications across the internet, they have become an obvious target for malicious actors looking to gain access to systems. If hackers present a cookie as their own, the website will typically grant them access as if they were the original user. Malicious actors often acquire these cookies through malware running on a user’s device, using the malware to silently steal cookies and

Catching Compromised Cookies | Engineering at Slack Catching Compromised Cookies – Engineering at Slack Skip to main content June 24, 2024 11 min read Catching Compromised Cookies How we automatically detect stolen session cookies Ryan Slama Sr. Software Engineer, Security Oliver Grubin Sr. Staff Software Engineer, Security Grace Li Sr. Software Engineer, Backend Search Latest Posts July 14, 2026 15 min read Shipyard: How We Built Slack’s Next-Generation EC2 Platform June 11, 2026 12 min read Agentic Testing: Where Agents Fit in the E2E Testing Stack May 28, 2026 17 min read Slack AI: Th

Explore this link on the map →

related reading