I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients cookies for the "Remember me ,User login" feature. Then just checking these two ids in the database, to see if it exist. Is this secure enough for a small website if https isn't an option as well? Any pointers?
Since the cookie isn‘t encrypted, the system is most susceptible to Man-in-the-middle (MITM) attack. The cookie can be intercepted on the network and then used to log in as the user. Putting UUID and OpenID in cookie without signing (via salted HMAC-SHA1) is bad. Actually, OpenID may and should be stored in database, while signed cookie will contain only "user id"—be it UUID or monotonically increasing integer, which is simply reference to database record in
users table. It is how it is done in "real world": “log in” form sets such cookie, “log out” form removes it (ensure that they both work only on HTTP POST, and do not forget about CSRF protection).
Even though attacker will be able to intercept such signed cookie via MITM attack, he wouldn’t be able to change it. That is, you’ll be able to detect such tampering, and you’ll be able to refuse to accept such cookie.
Use of HTTPS will mitigate MITM attack, therefore use HTTPS + cookie signing.