News for hackers. Stuff that matters.

A comment on Hackers Think Cookies Are Tasty, Too.

Re:Hackers Think Cookies Are Tasty, Too by ultimoo on Tuesday April 02, 2013 @04:16PM (#5481824)
Isn't it a widely adopted practice to encrypt the content of the cookie before setting it? Of course it could still be tampered with, but not as trivially.
[ Parent | on HN ]
Re:Hackers Think Cookies Are Tasty, Too by bensedat on Tuesday April 02, 2013 @04:28PM (#5481877)
Frameworks like Rails or Django offer options to encrypt or sign session cookies, but any other cookies are often left up to the developer to take care of. The HttpOnly and Secure flags are important to remember as well because otherwise a man-in-the-middle or rogue JS can modify them.
[ Parent | on HN ]