Is there any use case where you would store hashed credentials in a cookie?


I was discussing this problem with a colleague if it's advisable to do this. Since then, I found an example where a hashed password was used in the cookie.

Why would you even store hashed passwords inside a cookie?

Cookie Settings

  • 3
    Define "credentials". Session identifiers could be seen as credentials, in which case the answer is "yeah, pretty much always". If you're talking about passwords, then no, don't do that. – AndrolGenhald Feb 8 '19 at 16:09
  • I assume the asked is referring to username+password as credentials. I don't know of any valid use case for storing a hash of username+password in a cookie. – Daisetsu Feb 8 '19 at 16:25
  • not a good idea, imagine a xss attack like browser.cookies.getAll() – osanger Feb 8 '19 at 16:27
  • 3
    Just asking "is there any use case for ..." without any kind of context is a bit strange in my opinion. Either you stumbled over some application which behaves this way or some developer suggested this to you to solve a particular problem or you found some example code which does this and wonder where such thing could be used or ... . Please add this kind of missing context to your question. – Steffen Ullrich Feb 8 '19 at 17:59
  • I meant usernames and their corresponding passwords. Sorry for the confusion. Sorry for not providing the relevant information - This question came up in an discussion about securely using cookies. – HTTP502 Feb 11 '19 at 8:36

Browse other questions tagged or ask your own question.