I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (server must send data back in the cookies too, instead of regular response body).

Communication between servers established using HTTPS.

Can somebody explain what is the motivation of using cookies?

  • 1
    Are you asking if there is a security reason to use cookies? – schroeder May 21 '19 at 15:50
  • yes I guess there is a security advantage because of which it was chosen to use cookies – Pleerock May 21 '19 at 15:52
  • 5
    can you ask the people asking you to do this? – schroeder May 21 '19 at 15:53
  • 1
    Cookies are stored persistently. This means there is a much greater possibility of the data leaking from the cookie store. – schroeder May 21 '19 at 15:54
  • I don't know that there's any way for the community to answer this. We have no way to know what the motivations of the spec writer were/are, or if they were in any way security related. – Xander Jun 21 '19 at 2:01

Only thing I can come up with is the person making the specification knows about the security issues inherent in GET requests, does not know about POST requests, and does not know about how many cookie stealing vulnerabilities there have been over the years.

I don't know AJAX very well, but it's my impression there are both secure and non-secure ways to use it as well.


You have to consider both data at rest and data in transit here.

What about data in transit?

Data in transit is data that is being exchanged over the network between the client and the server. For the purpose of security, there is no difference between potentially sensitive data being sent as a cookie or in the request/response body. All of it is part of the message, so you have no advantage whatsoever between sending the content as a cookie or as the message body.

What about data at rest?

This is a more interesting part. Cookies are designed to give some sort of persistent storage while browsing the web, which was initially designed to be 100% stateless.

When a cookie is set by a website, the client saves the name, the content, the expiration date and some other metadata about it.

Furthermore, cookies are designed to be sent to the server on every request that you make. As a result, if you intend to send your message body via cookie, then the message body is also sent to any other resource of the same domain that you request (e.g. JavaScript, CSS, Images, etc.).

Another side-effect of storing data as cookies is that they remain persistent on the client, even when not in use. This means that an attacker, who is able to read out the cookies, can see the content of the messages.

Is there any advantage of using cookies instead of message bodies?

This question is like asking "Is there any advantage of using a frozen banana instead of a hammer?". Yes, you might be able to drive a nail in, but you also might break the banana. And your hands will get cold.

You see, you can hammer in a nail with a frozen banana, just like you can communicate solely using cookies (and some JavaScript that then transforms the cookies back to a regular message body). But there are disadvantages:

  • It requires extensive overhead, both in freezing the banana and in transforming the "message body" from the cookie back to a regular message body.
  • Such systems have not been tested as much. I trust a hammer not to break when hammering a nail into a wooden board, and I trust my browser not to break when receiving a message body. Usually.
  • You circumvent a lot of security measures designed for normal systems. For instance, for the purposes of your browser, all content is added "dynamically" to your DOM, which means it's treaten differently than content that was received in the message body.

In general, I would not do it. If there was an inherent flaw in sending data via message bodies, the system would be updated. This idea probably stemmed from someone who believes that anything that is considered a de facto standard is inherently bad and evil, and only TheirOwnSolution™ is the only secure way. It's generally safe to disregard their opinions.

  • 1
    Also, some users block cookies by default; some browsers do not support cookies; different browsers handle cookies differently (eg: limited space per cookie and limited space for all cookies per domain) – CaffeineAddiction Jun 28 '19 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.