---
# System prepended metadata

title: IS542 Project Idea

---

# IS542 Project Idea

**Title**: CERTificate-based Cookie Access control Tree (CERT-CAT)?

Cookie-access tree is designed to provide protection for cookies from attackers changing them from the client-side. The tree defines read / write permissions, for all possible cookies used or to be shared between the parent and subdomains. The tree is secured and verifiable by signing it with the parent domain's X.509 private key. The tree also defines usages by subdomains as X.509 certificates do and includes additional information such as HttpOnly. If a subdomain, e.g., *a.b.c*, wants to access cookies defined by the parent-domain, e.g., *b.c*, it cannot overwrite them with a tree for *a.b.c*. At most, it can add cookies for *(\*\*.)a.b.c*. Finally, a server **does not** need to sign the tree for each client; it is a "global" tree, as the X.509 certificates are.

The proposal requires modifications to the current cookie-access through javascript, which we aim to implement a prototype for. Also, the example of a cookie tree is described in the image below.

![](https://i.imgur.com/N5BTND2.png)
