CODEWITHSUNDEEP
cookiesencryption
Kirk Ouimet
Kirk Ouimet

Reputation: 28374

Do I need to sign/encrypt cookies if I am using SSL?

If I am serving all of my web content over SSL, do I need to do another layer of encryption and sign my cookie data?

Upvotes: 0

Views: 59

Answers (1)

Jonathon Reinhart
Jonathon Reinhart

Reputation: 137487

SSL/TLS only offers protection against communications being intercepted and/or modified. It guarantees nothing about text files sitting on a client's hard drive (i.e. cookies).

If you want to prevent a user from presenting your web application with falsified cookie information, then yes, you need to sign your cookie data. If you want to prevent a user from seeing the cookie data, then you should encrypt it as well.

Upvotes: 2

Related Questions