Collected research

Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)

Demonstrates visitor tracking that stores no cookie by abusing cached permanent redirects. A script tag requests a fixed URL, the server issues a 301 to a per-user address carrying a fresh identifier, and the browser caches that redirect and reuses the identifier on later visits, surviving restarts. A Ruby/Sinatra demo and source are published.

Record

Published by

scatmania.org

Topic

HTTP

In the archive

• Collected in the 2012 research round

Related sources

• Visitor tracking without cookies

Tags

• cache
• http
• cookie
• info-leak
• tooling
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of scatmania.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.