0

In our company we are using a tool for saving user profile data (like desktop settings, internet settings, cookies, etc.) into a database. During the annual cleanup of this database I discovered that lots of users have cookies, which are older than two years.

This leads me to the question: is it reasonable to block Cookies completely company-wide?

Do some security issues exists that support this idea, i.e. pros?

Or is this just a bad idea, e.g. in terms of user-comfort?

  • 5
    Only if it's also reasonable for people to be unable to use most transactional websites (e.g. Amazon, Gmail, quite a few Office 365 apps, etc...) – Matthew Mar 15 '17 at 12:12
  • 1
    Can you clarify your question? What do you mean by "block cookies"? I'm assuming that you do not mean that cookies will be completely blocked, but only some cookies, or only old cookies, or ...? – tim Mar 15 '17 at 12:28
  • Note that 2-year old cookies are nothing special. I currently have cookie files dating back to jan 2013 (and not older because I cleaned those out), some containing domains that I still visit. The question becomes: what maximum age is useful for cookies? – Jan Doggen Mar 15 '17 at 12:56
  • @tim blocking means not storing the cookies in the database. In general this is a read-only terminal server environment and we can explicitly setup which kind of data is stored for the next login of the user. – larkee Mar 15 '17 at 13:39
  • @larkee So the cookies would still be stored in the users browser for the session, but not be persisted once they log out of the machine? You might want to add that to the question. – tim Mar 15 '17 at 13:46
2

You can use black lists of tracker or advertisement websites (from ad-block software) to filter cookies that you can safely remove. You should leave legitimate cookies because you should not hinder your users in their work without a really good reason.

However, you can change default settings in the browsers to keep cookies until the browsers are closed. This will allow users to change the setting on the website that matters. You should document this change of policy and communicate it to your users before applying it.

  • I'd like to add that changing the default browser settings (and making it impossible for users to change) is a smart move. Also let browsers not remember passwords and set security settings to workable strength (that is company specific, like allow JavaScript or not). – Wealot Mar 15 '17 at 13:03
0

Surprising that the cookie database is still storing 2+ year old cookies. I have never seen that. Generally, most cookie generation logic implements an expiration policy - and expired cookies should be removed from the DB. But that's just one part of your problem.

Your main question is "blocking cookies enterprise-wide"? To answer that, its technically certainly possible and in some modern web-architecture that's one way of implementing security in websites - going cookie-less and using authentication tokens. Authentication token has lot of advantages over cookies - one being you don't really need to store them on DB anymore. But to implement authentication token architecture requires changes in the website/application's logic. You have to really do the cost benefit analysis.

Now, you have to remember one thing that there are many websites which supports only cookie based authentication. If you enforce no-cookie policy in your organization, then you cannot use those as well.

  • There are a great many cookies set with no expiration date (or one very far in the future). Check your own browser and you might be surprised. – Xiong Chiamiov Mar 15 '17 at 15:12
  • It can be in your browser but it should not be in the backend database. Application logic should clear old cookies from the DB. If you see his question, he is talking about the database and not the browser storage. – Shibasis Sengupta Mar 16 '17 at 0:03
  • In that case it would be sessions, not cookies that you're storing. But as I read the question, it appears to actually be client browser cookies that are being managed, in some sort of systems administration many-computer-administration software. – Xiong Chiamiov Mar 26 '17 at 22:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.