A Secure Cookie Protocol

Question

As title says I'm trying to implement a secure cookie protocol

HMAC(username|expiration name|data|session key, sk)

It seams that session key is not constant during whole application session lifetime. Now I'm not sure what to replace it with, someone suggested to me to use browser agent but it doesn't seem unique or too hard to produce, anyone has any suggestion?

I also wonder where should I store server key. (Hard code it into source code, or there is a batter solution?)

Answer 1

This session implementation does nothing to address OWASP a9. In short its vulnerable to a replay attack. So if a hacker is sniffing the network or has an XSS vulnerability in your site then they can just copy this value and use it.

You should use as little cryptography as possible. Cryptography is hard, it adds complexity and when it fails it can be disastrous.

A cookie should be a large cryptographic nonce, and reference server side state. You should transmit this cryptographic nonce as a cookie with all of the security flags enabled (httponly, Secure, and scope).

On a side note, Amazon AWS's RESTful authentication is not bad.