xauth and X11 forwarding
termsecurityIT support
The authorisation layer of the X Window System: xauth manages the MIT-MAGIC-COOKIE tokens that let a client open a window on your display, and X11 forwarding tunnels that protocol over SSH so a remote program can draw on your local screen.
X's model is inverted from what people expect - the display is the server and the application is the client - and its old alternative to cookies, xhost +, disabled access control entirely, which meant any host on the network could open windows, read your keystrokes and screenshot your session. That is why xhost + is a classic audit finding, and why SSH forwarding with proper cookie handling replaced it. Trusted forwarding still hands the remote side real power over your desktop, which is the modern caution.
Also known as: x11 forwarding, magic cookie, xhost, display :0