Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that is, prefixed with the user ID ******zXRL9DWpPtaAhkPzhemQZE5P5F), what are the potential security implications?

This would be to generate user identifiable access logs throughout various hops in a system, web servers, proxies etc. without the need to come up with schemes to pass around the user IDs.


  • 1
    GDPR might consider the user ID to be personal data (it depends on other factors that can be used to correlate to an identifiable person). Do you have any EU visitors to your web application? Google considers public user name to be PII for what that is worth. – DarkMatter Feb 26 '19 at 15:36
  • That's an interesting aspect. No EU visitors for now, but that may be a future possibility. The application is a payment related service, so the user identifiable logs can serve as audit logs. – allaroundnoob Feb 26 '19 at 16:39

It can have potentially serious implications. If the user authentication process use that User ID, an attacker can do a DOS attack sending wrong authentications data and locking User ID account.

If the User ID is not directly consistent to user personal informations (e.g. anonymization) it is not considered personal data.

| improve this answer | |
  • 1
    It's the same ID used for login, which is also a publicly visible handle (and stored in a cookie for rendering on the UI) similar to the "dotcom_user" cookie GitHub sets. – allaroundnoob Feb 26 '19 at 16:43
  • Login ID should never be stored on public area. If you need a unique identifier then use something else like HASH(Login ID) – WaltZie Feb 26 '19 at 16:48
  • Why is that a problem as long as it's a secure cookie only used for non-serious things like rendering a "hi userid" on the UI? GitHub sets a "dotcom_user" cookie with the username for example. – allaroundnoob Feb 26 '19 at 17:00
  • It's less secure than using a different information. Your security is based on server/client/browser security settings. One flaw on one of them and you give User ID information to an attacker. If you use something else like hash(User Id) ... you have not worry anymore about it. flaviocopes.com/cookies – WaltZie Feb 26 '19 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.