Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As title says I'm trying to implement a secure cookie protocol

HMAC(username|expiration name|data|session key, sk)

It seams that session key is not constant during whole application session lifetime. Now I'm not sure what to replace it with, someone suggested to me to use browser agent but it doesn't seem unique or too hard to produce, anyone has any suggestion?

I also wonder where should I store server key. (Hard code it into source code, or there is a batter solution?)

share|improve this question
I've seen this paper before. Do not use it. It's crap. It's eight years old and was written by some second-year post docs from Texas. Honestly. –  John Wu Nov 22 '13 at 1:26
add comment

1 Answer

up vote 1 down vote accepted

This session implementation does nothing to address OWASP a9. In short its vulnerable to a replay attack. So if a hacker is sniffing the network or has an XSS vulnerability in your site then they can just copy this value and use it.

You should use as little cryptography as possible. Cryptography is hard, it adds complexity and when it fails it can be disastrous.

A cookie should be a large cryptographic nonce, and reference server side state. You should transmit this cryptographic nonce as a cookie with all of the security flags enabled (httponly, Secure, and scope).

On a side note, Amazon AWS's RESTful authentication is not bad.

share|improve this answer
So you suggest to just generate random value, use it as a key to userID, and on each request get userID from server, thought if this is vulnerable to replay attack (and it seems to me it is) isnt secure cookie protocol batter approach as I dont need to store data on server which makes application a lot faster. –  F.T Sep 20 '12 at 0:21
@F.T Yes, its is vulnerable to a reply attack. Thats why the Secure and HTTPOnly flags are set. So that the cookie cannot be leaked with XSS or over the wire. Transmitting your session state in every HTTP request eats up your clients bandwidth. A memcachd session store on the same LAN is very fast. –  Rook Sep 20 '12 at 0:25
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.