64
votes
Why can't sockets be used to identify individuals instead of cookies?
A socket identifies a connection. Cookies are usually used to identify a user. If I open two browser tabs to SE.SE, I will have two connections and thus two sockets. But I want my settings to persist ...
- 104k
21
votes
Why can't sockets be used to identify individuals instead of cookies?
TCP sockets are designed to be stateful so in general they are used to identify sessions. Protocols like SSH and ftp do exactly this.
HTTP is designed to be stateless and each connection is only ...
- 1,463
12
votes
Accepted
cookie vs. session vs jwt
Cookies: in their early version, a text file with a unique client Id
an all the other information needed about the client (e. g. roles)
Cookies are tuples key-value originally addressed to retain ...
- 14.8k
10
votes
Accepted
Saving Passwords for autologin
But I don't know how should I encrypt password that when I save for autologin.
Autologin is not based on the password used in a manual login. There is a separate credential (based on identifying and ...
- 3,079
8
votes
cookie vs. session vs jwt
Cookies: in their early version, a text file with a unique client Id an all the other information needed about the client (e. g. roles)
Your definition of cookie doesn't really describe what they do. ...
- 9,217
7
votes
Accepted
Isn't it unsafe that any program can access cookies of a browser?
To expand on Robert's comment, from the moment you have a malicious program running on your machine, using your cookies is not the worst thing it can do to you.
It can, among others:
Add a ...
- 136k
6
votes
Should I encrypt my cookies using AES?
What you're describing is the same spirit of a JWT. JWTs aren't encrypted, but they're signed so you can verify authenticity. Nobody can forge a JWT unless they've cracked your key. I would recommend ...
- 9,217
6
votes
Storing an id of a shopping cart in a cookie for unauthenticated user
Simply store the entire shopping cart and contents in a cookie or other client side storage.
Then you don't need the database and there is no risk of a user gaining unauthorised access.
Plus it will ...
- 79.8k
6
votes
Accepted
How do you set cookies on frontend from the backend?
I was wrong that you couldn't set cookies between subdomains. Setting the domain on the set cookie header to mydomain.com solved the issue.
res.cookie('locale', JSON.stringify(localeObj), {
...
5
votes
Accepted
Cookie consent and facebook cookies?
Going against the law is not an option: first it might make you loose more visitors (i.e. those who count on you to respect their privacy). Second, GDPR fines calculated as percentage of your global ...
- 80.6k
5
votes
What are possible casue of broken websites when old cookies are present?
I think the most common issues are related to authentication.
You hit a webpage, its checks for an auth cookie and if there isn't one you go through the auth flow and get a cookie
But! now you are ...
- 79.8k
5
votes
How do you set cookies on frontend from the backend?
From Define where cookies are sent:
Domain attribute
The Domain attribute specifies which hosts are allowed to receive the cookie. If unspecified, it defaults to the same host that set the cookie, ...
- 231
4
votes
Accepted
Is it a bad practice to use cookies for a Desktop Application?
In principle, there's no problem with using HTTP/REST to communicate between a desktop app and a backend. In that context, it can also be a great idea to use various HTTP features. This might include ...
- 135k
3
votes
Accepted
Should I store session id in server database?
First, model the situation correctly.
We have a one-to-many relationship between user and sessionid.
An attribute of a session is its expiration timestamp.
So we will want a three-column table with
FK
...
- 7,605
3
votes
How to authenticate front end with backend in an anonymous user flow
Put another way, how do we allow the ReactJs app to call our API but not someone hitting our API directly?
You can't. Not possible.
You can make it a bit difficult by having the app obfuscated and ...
- 51.4k
3
votes
Can I use a session cookie for API authentication?
You can and some systems do use this method, but it has some flaws you will have to deal with.
You will need to expire it to avoid man in the middle attacks gaining permanent access.
You will need to ...
- 79.8k
2
votes
Isn't it unsafe that any program can access cookies of a browser?
Security is a matter of degree, and reasonable expectations.
All true multi-user-systems (Windows NT, Unixoids, ...) try to make sure that one users programs cannot interfere with another users data ...
- 9,131
2
votes
Saving Passwords for autologin
Wiring as Answer as it exceed comment limit.
You need to follow HTTP protocol. saving password by some homegrown solution is inherently unsafe. Even if you dont have access to server you have access ...
- 251
2
votes
Is a cookie hash that matches with file hash safe?
I agree with nadir that this is not a space where you should 'roll your own' but I think it's long overdue that we start talking about how these things go wrong because it's the app developers that ...
- 28.9k
2
votes
How to keep user logged in when using OpenID Connect & Cookies in dotnet core?
I did this myself recently and it's a bit of a pain, largely due to the limitations on the extension method setup methods which restrict your control over the component, forcing you to use CookieAuth ...
- 79.8k
2
votes
How can a third-party site know your identity on other sites (e.g. Off-Facebook Activity)?
"I'm sure there's not global browser state that any website can write to, right"
Yes and no. Say I own the domain "genericadverts.com". I goto various companies with websites and ...
- 79.8k
2
votes
What cookies are sent to the server during an API call?
I think the key here is to understand how HTTP, the protocol of the web, works. As a user, it's easy to think in terms of "navigating a site", and "being sent from one site to another&...
- 5,887
2
votes
What cookies are sent to the server during an API call?
You are correct that a cookie is only send back to the originating domain. In a CSRF-attack, the attacker never gets direct access to the cookie, but tricks the victim into send a malicious request to ...
- 61k
1
vote
Roy Fielding’s REST alternative to HTTP cookies
HTTP was initially designed as a stateless protocol, which means a server should not need to maintain any client-specific session state between requests. Instead all information necessary to process a ...
- 61k
1
vote
Accepted
Roy Fielding’s REST alternative to HTTP cookies
Just to disambiguate things a bit. "Application State" in REST is used to describe the state of the conversation taking place. So how far are you in your order process, on which page are you ...
- 12.3k
1
vote
How to keep user logged in when using OpenID Connect & Cookies in dotnet core?
Don't use refresh tokens to keep the user logged in! Refresh tokens are intended for offline access, i.e. background processed where the user is not present at all.
The correct way to handle this ...
- 1,748
1
vote
Accepted
Is a cookie hash that matches with file hash safe?
There has been many great answers and comments. I think it's unfair to accept one of them because every answer put something to the table. Instead I'll make a summery.
Problem
Don't use predictable ...
- 149
1
vote
Is a cookie hash that matches with file hash safe?
There are three important things for me:
1. Unpredictable Code:
Your code should not be predictable. You are using username and hash. If this hash is static or predictable, it is really important ...
- 927
1
vote
Is a cookie hash that matches with file hash safe?
For example; if someone got his hands on the username and hash "somehow", he can impersonate this user on your service and act on her behalf.
It's discouraged, even more so as a software-engineer, to ...
- 773
1
vote
Authentication via tokens
Your workflow is correct (assuming you are using HTTPS), and yes you could just store your token in a Cookie instead of passing it in the authorization header.
I don't recommend using OAuth2. ...
- 1,748
Only top scored, non community-wiki answers of a minimum length are eligible