1

Recently I had to use a website which stored things like user role (user or admin) in a cookie.

When I modified the username the displayed username changed in the website.

I immediately asked the developers of said website if it's secure to store the user role in a cookie if you can just modify it. They told me that you could only break the UI of said website and that the back-end always checks the session cookie for important actions.

So let's say I want to build my own website and store things like user-type: admin or user in a cookie.

Is it safe to store the user type in a cookie if it's only used for UI purposes and not back-end purposes?

1 Answer 1

2

"Safe" is always a relative term. If the data in the cookie is not used for authentication or authorisation, and it is just a configuration item that is exposed and could be used by anyone without a risk of misuse/abuse, then why not? The letters a d m i n are not special in and of themselves.

At that point, it's just a UI toggle switch, just like dark/light mode.

The real question is about knowing the potential impacts of such a change.

The risks are about some future developer of the site misusing the cookie for sensitive things without understanding the consequence.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .