Cookies And Security

[danovotny]

Hey,

This is a curosity question. When setting cookies, they are typically stored on your hard drive, thus making some information they contain available to users. However, when setting a cookie in PHP and you set the expiration to '0' .... it becomes a 'session cookie' that is only stored in temporary space.

So I have two questions:

1. Can a 'session cookie' be viewed somehow by a user?

2. Can any type of cookie's name and/or value be obtained by using an outside script or homemake browser?

[mtmosier]

Yes, it's possible for the end user to view a cookie even if it is a session cookie. The values in cookies may also be modified by the user.

If you need to store sensitive information in a cookie encrypt it first.

[danovotny]

I recently had mcrypt installed on our server, and haven't gotten to play with it much.

One thing I'm not too sure about is the IV.... wouldn't you have to keep track of the IV in order to consistently decrypt a message?