I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients cookies for the "Remember me ,User login" feature. Then just checking these two ids in the database, to see if it exist. Is this secure enough for a small website if https isn't an option as well? Any pointers?

  • I think that even though you consider the remember me cookie, you can still present the user with a captcha after considerable random intervals so that the user authentication is verified. Also, for every request you can ensure that the user's authentication is right and the roles and privileges for this user are still coming from the DB than from the cookies. – Saravanan Mar 21 '13 at 5:26

Since the cookie isn‘t encrypted, the system is most susceptible to Man-in-the-middle (MITM) attack. The cookie can be intercepted on the network and then used to log in as the user. Putting UUID and OpenID in cookie without signing (via salted HMAC-SHA1) is bad. Actually, OpenID may and should be stored in database, while signed cookie will contain only "user id"—be it UUID or monotonically increasing integer, which is simply reference to database record in users table. It is how it is done in "real world": “log in” form sets such cookie, “log out” form removes it (ensure that they both work only on HTTP POST, and do not forget about CSRF protection).

Even though attacker will be able to intercept such signed cookie via MITM attack, he wouldn’t be able to change it. That is, you’ll be able to detect such tampering, and you’ll be able to refuse to accept such cookie.

Use of HTTPS will mitigate MITM attack, therefore use HTTPS + cookie signing.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.