Contents
The answer is yes. To safely store data in a cookie you have to encrypt the data you want to store then sign the encrypted data. Encrypting it prevents attackers from being able to read the data, signing it prevents attackers from modifying the data. This will ensure the integrity of the data.
It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim’s computer (see HTTP cookie theft).
How easy is it to steal cookies?
Stored cookies can also be stolen using Cross-Site Scripting (XSS). If an attacker can see cookie data, then it is easy for them to “steal” it. They can forge a request and include the cookie data as if it were their own.
Why do we need to encrypt cookies in http?
HTTP cookies often come from the web server so consider encrypting cookie values. This adds a layer of protection since the browser client can’t decrypt the data. This makes it so that HTTP cookies are meaningful only to the back-end application. Server-side encryption adds more protection because the client can’t sniff the cookies.
A cookie with the Secure attribute is sent to the server only with an encrypted request over the HTTPS protocol, never with unsecured HTTP (except on localhost), and therefore can’t easily be accessed by a man-in-the-middle attacker. Insecure sites (with http: in the URL) can’t set cookies with the Secure attribute.
In order to prevent an HTTP page from setting a secure cookie would result in two possibilities: All HTTP-provided cookies are not accessible when visiting the HTTPS page. This would be a significant break in compatibility. Or Metadata is added to the Client-provided Cookie value so that the server can know some things about it.
Can you use HTTPS when issuing a cookie?
To overcome the issue, we can use HTTPS when issuing the cookie and add the Secure flag to it: this instruct browsers to never send this cookie in plain HTTP requests.