Preventing HTTP cookie stealing using cookie morphing

A client comprising:

• a memory;
• at least one processor configured to:
• receive, from a device, an authentication cookie for access to a server, the device maintaining a sequence number and a cryptographic secret;
• receive, from the device, a cookie engine, the cookie engine being executable code that when executed generates validation cookie information;
• generate, using the cryptographic secret and the cookie engine, validation cookie information with an updated sequence number increased by the client by a predetermined defined value responsive to generating the validation cookie information;
• and
• send, to the device via a hypertext transfer protocol (HTTP) message, the authentication cookie, and the validation cookie information with the updated sequence number to validate the authentication cookie.

A method comprising:

• sending, by a device to a client, an authentication cookie for access to a server, the device maintaining a sequence number and a cryptographic secret;
• sending, by the device to the client, a cookie engine, the cookie engine being executable code that when executed generates validation cookie information, wherein the validation cookie information is generated with an updated sequence number at the client using the cryptographic secret and the cookie engine;
• receiving, by the device from the client via a hypertext transfer protocol (HTTP) message, the authentication cookie, and the validation cookie information with the updated sequence number increased by the client by a predetermined defined value responsive to generating the validation cookie information;
• and
• determining, by the device according to the validation cookie information and the updated sequence number, whether to validate the authentication cookie.