Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?

share|improve this question
add comment

3 Answers

up vote 8 down vote accepted

I don't think you gain a lot since they'd still be associated with the site, or some sub-domain of it.

As for the downsides, you'd have to have some lookup to figure out what the name for a particular cookie is so you can know where the data you stored previously can be found.

I think you're better off not worrying about it, and instead make sure you only store some unique identifier so you can tell who it is, provide adequate security to keep others out of their account, and store all other user-related data internally in your own back-end database.

share|improve this answer
add comment

The only upside to randomizing cookie names, is if you have reason to believe a given cookie might be overridden by different cookies with the same name.
For example, multiple instances of the same app on a single webserver. Or, shared hosting - you never know what someone else will put in...

But then, there are better solutions - such as scoping the cookie to the specific path... Everything else is just security by obscurity.

And the downside, is as @Greg pointed out.

share|improve this answer
add comment

I could envision how randomizing cookie names could prevent Related Domain Cookie attacks

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

One possible solution is where the cookie name is a hashed value corresponding to the user name, etc and acts as a checksum against this type of attack. In other words, cookie names with an invalid name/hash would be discarded

Example

normalcookieName_SomeHashedValueBasedOnSessionID
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.