Storing sensitive data in plaintext in a cookie makes the data more easily accessible than if encrypted. This significantly lowers the difficulty of exploitation by attackers.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Demonstrative Examples
Example 1
The following code excerpt stores a plaintext user account ID in a
browser cookie.
(Bad Code)
Example
Language: Java
response.addCookie( new Cookie("userAccountID", acctID);
Authentication information stored in cleartext in
a cookie.
Potential Mitigations
Sensitive information should not be stored in plaintext in a cookie.
Even if heavy fortifications are in place, sensitive data should be
encrypted to prevent the risk of losing confidentiality.
Description
