I want to track a user who has previously logged in so that I can associate traffic behavior with their user record on our system. Does storing the user's id as a single value in a cookie cause security issues?
3
-
probably not... many sites would even use a userid in a GET. I suppose it depends on whether a user's info is private or not. If they don't have a publicly available "profile" it might be something to avoid... or at least to hash and use that hash for the tracking tables? (It might give an attacker info that could lead to revealing private information... for instance checking for links across the web that refer to that uid on that site.)– pcalkinsJul 30, 2021 at 18:50
-
What kinds of security issues are you talking about? There are numerous privacy issues and regulations. There are potential threats to your server and potential threats to the user. Can you narrow down what you are asking about?– schroeder ♦Jul 31, 2021 at 8:22
-
I am referring to any issues that would deal with an attacker knowing an auto increment id or even being able to change the value because it's accessible in the browser.– AnonymousCowardAug 2, 2021 at 3:10
Add a comment
|
1 Answer
It depends on how you validate the user id. Remember, cookies are user-supplied data, and should not be blindly trusted. If you want to save the userId on a cookie, make sure that you can detect when the user changed the cookie.
You could use JWT for that, so if the user modifies the cookie, the signature won't match and you can discard the cookie. Otherwise the user can impersonate anyone just by changing the cookie that he controls entirely.
answered Jul 30, 2021 at 19:16
