Im currently working on a personal full stack application using cookies with the express-session middleware. Theyre secured with some sort of secret. Im not really too sure how that works but I think it jumbles/hashes up the cookie (let me know if I'm incorrect). So if I store some data in my cookie like for instance the auto incrementing primary Id column in my database Is it possible for someone to "crack the cookie and change there information from say:

{ #user1id
  userId: 1


{ #user2id
  userId: 2

and gain user2's private information?

So in the case this is possible and I were (I'm not, but hypothetically) making a social media platform with a large userbase, should I use something like uuids so its basically impossible to spoof or not use cookies at all and opt for something "more secure"?


  • Why would you store this in cookie and why you will use the info from this cookie ? I mean isn't it better if this will be in the session variable ?
    – mrSotirow
    May 16 at 15:35
  • 1
    It's impossible to answer, "What are the risks of X?" (which is what you are asking), if you can't tell us what X is. You may as well ask, "My house door has some sort of lock, which needs some sort of a key to open. Can someone pick my lock?" It's not possible to answer that question. May 16 at 16:36
  • @mrSotirow This, plus crypto, is common for stateless cookies and tokens. May 25 at 1:47

It depends on the implementation. Insecure methods exist, such as only encrypting the data with AES-CBC, where the contents can often be modified even if they can't be decrypted.

The secure method is to use a cryptographic algorithm to verify integrity of the data. For example, HMAC can be used to verify the contents are unmodified. JWTs are a common example of doing this in practice. As long as the secret key is safe, the tokens cannot be modified.


I would recommend that you store the information in a server side session instead. The issue with your described implementation is that there is no expiry or way to manage the values of the cookies besides blindly trusting the cookies.

  • If a user saves all the cookies they come across they can potentially replay different cookie values to different forms/functions to manipulate the input.

  • An attacker could steal a cookie and re-use it and the cookie couldn't be invalidated to stop the attack.

  • Even if data is encrypted correctly, bit flipping attacks may still succeed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.