Storing sensitive data in plaintext in a cookie makes the data
more easily accessible than if encrypted. This significantly lowers the
difficulty of exploitation by attackers.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Demonstrative Examples
Example 1
The following code excerpt stores a plaintext user account ID in a
browser cookie.
(Bad Code)
Java
response.addCookie( new Cookie("userAccountID", acctID);
Authentication information stored in cleartext in
a cookie.
Potential Mitigations
Phase
Description
Sensitive information should not be stored in plaintext in a cookie.
Even if heavy fortifications are in place, sensitive data should be
encrypted to prevent the risk of losing confidentiality.
Description
