I am making a website and I thinking about security regarding cookies. I know that is important for the cookies to be secure and I am worried about that.

  • What are the main points to consider?
  • What should I do to secure cookies?

Cookies can have several settings turned on:

  • secure: The cookie is sent only using HTTPS. Should be turned on.
  • httponly: Prevents javascript and other scripting languages from accessing the cookie. Should be turned on unless you use the cookie in javascript.
  • domain: Makes cookie available only to the domain and its subdomains. Should be set to prevent cookie theft.
  • path: The path where the cookie should be available, can be set to slightly improve security.
  • expire: Can be somewhat useful in some situations, but you should revoke tokens in cookies in a different way, as this can be ignored by the user.

The content of the cookie is not secret from the user. If it is supposed to be, you should encrypt it. If there is something very sensitive in the cookie, first consider not putting it there at all and if you have to, encrypt it if possible.

The content of the cookie can be changed by the user. If that is a problem, sign the cookie somehow (either public key cryptography or HMAC or AES in GCM mode to combine with encryption).

If the cookie contains a token that should expire, either hold the expiration on the server or have it in a signed cookie, so it can't be changed.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.