# Security risks of cookie-based session storage

**URL:** <https://www.ruby-forum.com/t/security-risks-of-cookie-based-session-storage/160998>\
**Category:** Rails\
**Created:** [February 22, 2009, 12:17am UTC](https://www.ruby-forum.com/t/security-risks-of-cookie-based-session-storage/160998 "2009-02-22T00:17:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric99](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/a88e4f/32.png) [@eric99](https://www.ruby-forum.com/u/eric99)\
**Post date:** [February 22, 2009, 12:17am UTC](https://www.ruby-forum.com/t/security-risks-of-cookie-based-session-storage/160998/1 "2009-02-22T00:17:22Z")

</div>

Should I be concerned if I am using the default cookie-based session  
storage for a high security application? Nothing sensitive will be  
stored on the cookie, but it’s critical that one user cannot gain  
access to another user’s account. The security risks I see with  
cookie-based storage are:

1. There is a single point of failure. If the secret key is stolen  
(for example, by a rogue developer), the person in possession of the  
key can log into any account he wishes.

2. It’s not been as widely used as database-backed session, and  
therefore not as tested.

3. The cryptographic algorithm could be compromised, which is always a  
possibility (however unlikely.)

What do you think?

Eric

---

<div class="post-metadata">

**Author:** ![eric99](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/a88e4f/32.png) [@eric99](https://www.ruby-forum.com/u/eric99)\
**Post date:** [February 22, 2009, 12:21am UTC](https://www.ruby-forum.com/t/security-risks-of-cookie-based-session-storage/160998/2 "2009-02-22T00:21:28Z")

</div>

On Feb 21, 5:06 pm, “Eric L.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> 1. It’s not been as widely used as database-backed session, and  
> therefore not as tested.

given that it’s been the default for well over a year I would question  
that.

> 1. The cryptographic algorithm could be compromised, which is always a  
> possibility (however unlikely.)

While the risks in 1 and 3 do exist I don’t think it’s a game changer  
compared to the other risks involved (people setting weak passwords,  
the cryptographic algorithm securing your ssh or ssl sessions being  
compromised and data being leaked that way, the rogue developer  
harvesting data straight from the database, cookies being stolen via  
XSS attacks etc.)

Fred

---

<div class="post-metadata">

**Author:** ![eric99](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/a88e4f/32.png) [@eric99](https://www.ruby-forum.com/u/eric99)\
**Post date:** [February 24, 2009, 3:31am UTC](https://www.ruby-forum.com/t/security-risks-of-cookie-based-session-storage/160998/3 "2009-02-24T03:31:40Z")

</div>

Good point. I realized risk #1 could be reduced by storing the secret  
in a secure place on the deployment server rather than under source  
control.

On Feb 21, 3:20 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)