Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that is, prefixed with the user ID ******zXRL9DWpPtaAhkPzhemQZE5P5F), what are the potential security implications?

This would be to generate user identifiable access logs throughout various hops in a system, web servers, proxies etc. without the need to come up with schemes to pass around the user IDs.


  • 2
    GDPR might consider the user ID to be personal data (it depends on other factors that can be used to correlate to an identifiable person). Do you have any EU visitors to your web application? Google considers public user name to be PII for what that is worth.
    – DarkMatter
    Commented Feb 26, 2019 at 15:36
  • That's an interesting aspect. No EU visitors for now, but that may be a future possibility. The application is a payment related service, so the user identifiable logs can serve as audit logs. Commented Feb 26, 2019 at 16:39

1 Answer 1


It can have potentially serious implications. If the user authentication process use that User ID, an attacker can do a DOS attack sending wrong authentications data and locking User ID account.

If the User ID is not directly consistent to user personal informations (e.g. anonymization) it is not considered personal data.

  • 1
    It's the same ID used for login, which is also a publicly visible handle (and stored in a cookie for rendering on the UI) similar to the "dotcom_user" cookie GitHub sets. Commented Feb 26, 2019 at 16:43
  • Login ID should never be stored on public area. If you need a unique identifier then use something else like HASH(Login ID)
    – WaltZie
    Commented Feb 26, 2019 at 16:48
  • Why is that a problem as long as it's a secure cookie only used for non-serious things like rendering a "hi userid" on the UI? GitHub sets a "dotcom_user" cookie with the username for example. Commented Feb 26, 2019 at 17:00
  • It's less secure than using a different information. Your security is based on server/client/browser security settings. One flaw on one of them and you give User ID information to an attacker. If you use something else like hash(User Id) ... you have not worry anymore about it. flaviocopes.com/cookies
    – WaltZie
    Commented Feb 26, 2019 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .