Re:Is it OK to hold credit card numbers in cookies, Santander?
by dgoodlad on Monday October 15, 2012 @04:04PM
(#4656908)
That's how _some_ session tracking works. See Rails' CookieStore strategy for session storage for example: http://guides.rubyonrails.org/security.html#session-storage
> Rails 2 introduced a new default session storage, CookieStore. CookieStore saves the session hash directly in a cookie on the client-side. The server retrieves the session hash from the cookie and eliminates the need for a session id. That will greatly increase the speed of the application, but it is a controversial storage option and you have to think about the security implications of it:
Re:Is it OK to hold credit card numbers in cookies, Santander?
by chris_wot on Monday October 15, 2012 @04:16PM
(#4656957)
That's not how secure session management works.
Re:Is it OK to hold credit card numbers in cookies, Santander?
by cheald on Monday October 15, 2012 @11:38PM
(#4658353)
It's plenty secure in the sense that you can't forge a session. It's not secure in the sense that the data is inaccessible if you know how to base64 decode a cookie.
If you're using cookie sessions, you should know better than to store sensitive information in the session.
No, that's not how session tracking works. The server uses a cookie to assign you a temporary ID, and then creates a corresponding storage area "server side" which can contain data like credit card numbers.