I might be completely making this up as a solution or even feasible.
I have a situation where a cookie exists for a browser/user/tab. In the background, while the user is viewing a page a request is made regularly to the backend. The cookie is passed as part of this flow.
The backend updates the cookies content each time the request is made. The cookie's content is encrytped so its unreadable from the fronend browser. The Set-Coookie
header is used to get the browser to update the cookie. All good so far.
The system falls down if a bad actor were to have one tab open which polls in the background for the cookie update, but uses another tab (on the same site), with the original cookie, however doesn't allow the second tab to actually adhere to setting the cookie with Set-Cookie
- i.e the cookie will always be the value from whatever the first tab has set it as, not the second tab.
I think what I need is a way to stop cookie reuse. For this to work I either need some key value store that keeps track of all historical cookies for a user (could be alot of information) but what I think would work is if I knew the value of a previous cookie and could work out if a cookie was generated from the value of this previous one - I think this would mean I only ever need to store the previous cookie, anything that is not generated from a value of this one is invalid.
I'm thinking of storing within the cookie data a "seed" a bit like a random number generator uses. This seed is used to generate a value which is stored in the next cookie. Its random in as much as anyone else knows but if you know the seed from the previous cookie, you can "predict" what the value will be in the next cookie. If its not that, its invalid. I sort of got the idea from blockchain blocks and the known next block etc.
Is there a formal method to doing this anyone can point me in the direction of. The requirements are that the cookie content changes very regularly so storing a history of all previously used cookies is unfeasible.
Or I might not be understanding and there is another better way entirely?