0

i want to store session information in android application temporarily (as long as application is running). i am sending real-time data to node.js server from android client using Custom Protocol (over UDP). Along with this data i will send cookie (or session string unique to each user) to server for further processing. is this a safe way to store cookie in ram. Is this safe for users?

I am new to this security stuff so i want help. if i have missed any information i am willing to add it.

2 Answers 2

1

is this a safe way to store cookie in ram

How do you know it will be stored in RAM?

What is your definition of safe?

Custom Protocol (over UDP)

Unless that's using DTLS it's probably not safe.

There are ways of implementing a secure model around this - the concept of storing session data client side is not new - but you also have big potential issues around authenticity (i.e. preventing client side tampering).

4
  • i would store cookie in a variable so as long as the app is running the variable will have the cookie value in ram. May 8, 2020 at 9:16
  • No - the browser deals with the cookie and decides where to store it. If you copy that to a javascript variable, then it is likely that the copy will only be stored in RAM (but far from certain).
    – symcbean
    May 8, 2020 at 10:47
  • i am making android application as mentioned in question. May 8, 2020 at 11:01
  • Doesn't matter. There are 4 possible ways to implement this - using the embedded browser in dalvik, using a third party HTTP component in Dalvik or as an HTML5 app - all of which effectively mean you are using a browser. The fourth option would be that that you are writing your own HTTP stack from scratch - which would be very silly.
    – symcbean
    May 8, 2020 at 11:27
0

Instead of how it's stored I find it much more alarming that it's transmitted over a custom network protocol. It might either be completely unencrypted or encrypted with a homespun implementation. That's how you are really going to leak the cookies.

1
  • i am going to implement a DTLS and TLS channel for transferring cookies and data to client. so will it be considered secured? May 8, 2020 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .