I want to track a user who has previously logged in so that I can associate traffic behavior with their user record on our system. Does storing the user's id as a single value in a cookie cause security issues?

  • probably not... many sites would even use a userid in a GET. I suppose it depends on whether a user's info is private or not. If they don't have a publicly available "profile" it might be something to avoid... or at least to hash and use that hash for the tracking tables? (It might give an attacker info that could lead to revealing private information... for instance checking for links across the web that refer to that uid on that site.)
    – pcalkins
    Jul 30, 2021 at 18:50
  • What kinds of security issues are you talking about? There are numerous privacy issues and regulations. There are potential threats to your server and potential threats to the user. Can you narrow down what you are asking about?
    – schroeder
    Jul 31, 2021 at 8:22
  • I am referring to any issues that would deal with an attacker knowing an auto increment id or even being able to change the value because it's accessible in the browser. Aug 2, 2021 at 3:10

1 Answer 1


It depends on how you validate the user id. Remember, cookies are user-supplied data, and should not be blindly trusted. If you want to save the userId on a cookie, make sure that you can detect when the user changed the cookie.

You could use JWT for that, so if the user modifies the cookie, the signature won't match and you can discard the cookie. Otherwise the user can impersonate anyone just by changing the cookie that he controls entirely.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .