Cookie security

[Crundy]

Hello,
Is it secure, after authenticating someone, to send them a session cookie containing their username which subsequent pages can then use to see if they have logged on or not, and who they are?

Could someone else just set a cookie with username="whoever" and set the domain to your domain, then just browse your protected pages? Is it possible for someone to trick your server into thinking that a cookie set elsewhere was set by your server? C:\DOS:>
C:\DOS:>RUN
RUN DOS RUN!!

 

[chiph]

Crundy -

This used to be possible, but I don't know about if it still is (with the newer browsers).

I would say that you'd want to encrypt the contents of the cookie with a key you keep on your site (don't store the key in Javascript, of course).

Chip H.

 

[Crundy]

I had a conversation with others about this topic in the ASP forum. See thread333-228857 for details C:\DOS:>
C:\DOS:>RUN
RUN DOS RUN!!