What is cookie security?

Continuing the topic of site user data security, today we will touch on the issue of cookies. So, let's understand what is cookie security?

What is a cookie?

Cookies – this is data (a small fragment) sent by the server, which is stored on the user's computer. Accordingly, every time a computer connects to a website, it sends this data in an http request. What is this data that is impartially given to the server from our computer:

• user authentication
• storage user settings
• user statistics
• user access sessions

After reading the first paragraph, it is worth considering. The actual leaving words authentication – just a password and username. In fact, it turns out that the browser just provides the most intimate things.

We will not move on to the topic now: "How to secure your cookies", now we will talk about what site owners should do to build the right security policy for users.

What is cookie security?

Let's imagine that we have already acquired an SSL certificate and our website is connected via the https protocol. What to do with cookies? First, let's look at what the creators of the browser did for "security"; our data:

• Browser can store up to 300 cookie values
• each cookie can't exceed 4KB
• up to 20 cookies can be stored per server or domain

Not a lot, right? In fact, these cookies are needed by the server for our pleasant use of the browser and Internet resources. Think if every time you log into VK you would have to enter a password? Yes, of course, there are Web users who do just that because their browser does not store cookies. And every time you visit the server, the browser transmits new information and does not contain outdated information.

In addition, cookies store downloaded data from the site if you have visited it once. When you visit again, the page loads faster.

But there are sites that require, according to their subject matter, to drop cookies every time you exit the browser or site. For example, these are the websites of banks or online payment systems.

How to generate cookies?

On the site side, cookies can be set using php or javascript. With their help, you can form the lifetime of these files, the maximum size, etc. For example, in php there are INI – session security settings. Same functions “session.cookie_lifetime = 0 “

You can set up auto login and much more, the entire list of these settings can be found in the official php documentation.

Ways to save user data:

1. Data encryption. This was provided to us by SSL
2, Checking the browser, namely checking the http-header field user-agent
3. The duration of the session. You can change or reconfigure in the php.ini and. htaccess
4. Binding to an IP address. Usually used only when the number of users is limited and they have static IP addresses.

Unfortunately, the possibility of cookie hacking or theft cannot be completely ruled out, but the list of recommendations above will help protect against low-mid-level hackers.