My company has a travel app which helps you buy tickets for work related travels. When you need to travel you enter your details on SAP and it it sent to your manager for approval. When it is approved, you open the travel app. The app sends a request to the SAP system and gets your confirmed travel details with your personal info. All data is then base64 encoded and sent to the browser in a cookie. This cookie goes with all requests. I objected this architecture because the cookie contains sensitive data. I suggested we keep a session in the travel server and retrieve the sensitive data when needed but developers don't want to do that. They say it requires too much effort. Is there a more secure alternative to this design where we don't keep the sensitive data in a cookie?

  • 1
    Likely none that would take even less effort to implement with comparable security. Mapping a unique ID to the data that is handled in the backend is the accepted way to do this. Perhaps they don't understand the risks? If there is any XSS in the application the data is at direct risk. Depending on what and where your company is it is also highly non-compliant. – J.A.K. Dec 3 '18 at 18:11
  • cookies are safe if you use https. well, as safe as the rest of the app, which is all we can hope for. – dandavis Dec 3 '18 at 20:20
  • 2
    Tell the developers to stop being lazy. What you describe is so bad there's a CWE for it, see cwe.mitre.org/data/definitions/315.html If the data is kept in the cookie (bad), then at least encrypt it. As mentioned already (and as you already know), any sensitive data should be kept on the server. – Swashbuckler Dec 3 '18 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.