Is there any use case where you would store hashed credentials in a cookie?


I was discussing this problem with a colleague if it's advisable to do this. Since then, I found an example where a hashed password was used in the cookie.

Why would you even store hashed passwords inside a cookie?

Cookie Settings

closed as too broad by Xander, Steffen Ullrich, Conor Mancone, AndrolGenhald, schroeder Feb 9 at 16:08

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Define "credentials". Session identifiers could be seen as credentials, in which case the answer is "yeah, pretty much always". If you're talking about passwords, then no, don't do that. – AndrolGenhald Feb 8 at 16:09
  • I assume the asked is referring to username+password as credentials. I don't know of any valid use case for storing a hash of username+password in a cookie. – Daisetsu Feb 8 at 16:25
  • not a good idea, imagine a xss attack like browser.cookies.getAll() – osanger Feb 8 at 16:27
  • 3
    Just asking "is there any use case for ..." without any kind of context is a bit strange in my opinion. Either you stumbled over some application which behaves this way or some developer suggested this to you to solve a particular problem or you found some example code which does this and wonder where such thing could be used or ... . Please add this kind of missing context to your question. – Steffen Ullrich Feb 8 at 17:59
  • I meant usernames and their corresponding passwords. Sorry for the confusion. Sorry for not providing the relevant information - This question came up in an discussion about securely using cookies. – HTTP502 Feb 11 at 8:36

Browse other questions tagged or ask your own question.