I'm creating a web application, and want to allow users to log in (and stay logged in). My plan to support this in a secure way goes as follows:
- User logs in from a login form - when successful, the server responds
HttpOnlycookie that simply contains their username.
When the user closes their browser and later comes back, a request is submitted (which includes the cookie) to an endpoint on the server upon page load that asks the server if the current user is logged in, which the server determines by the presence of the cookie. If so, the server returns the value of the cookie, which the client-side can display on the UI as the user's username.
Any request that requires an authenticated user (such as saving or updating data) will do so under the name of the username specified in the cookie in each given request.
One major question I have - if someone goes into their browser and manually changes the
username cookie using devtools, would this allow them to make requests under the guise of another user with the way I have this laid out? Or does
HttpOnly prevent this?
Am I overcomplicating this? Do I gain anything by making this cookie
HttpOnly, since I'm essentially allowing the clientside to read it anyways? Is my approach even secure?