2

Usually, the risks of persistent cookies are described from the point-of-view of the site, not the user: if you implement persistent cookies the probability of someone stealing a cookie and using it to access your site without proper authorization is higher.

In the past, misinformation led to people to think that cookies my carry malware or something similar, that we today know is not feasible because cookies are stored as plain text files.

The main threat I visualize is that if you store persistent cookies if someone access your PC he/she may steal the cookie and impersonate you in the site.

Do you visualize any other risks from the point of view of the user?

2

The two main threats are:

  • Physical or logical access - an attacker stealing authentication token values to use themselves, either physically at the machine or via some malware vector.
  • XSS - a remote attacker stealing cookies using an XSS vulnerability. With persistent cookies this would not require the user being logged in during a recent session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.