Securing a cookie in user browser | Community
Skip to main content
M
Mahesh_Gunaje
Level 7
February 18, 2024
Solved

Securing a cookie in user browser

  • February 18, 2024
  • 1 reply
  • 536 views

Hello team,

 

How can I secure the users cookie? In my application, we are saving the idToken, accessToken cookie in browser. We have enabled HttpOnly, Secure flags to these fields.  Still, I came to know that a techie end user can modify these cookie values.

Also, in the application logic, we are writing the logic as, if idToken is present in the browser cookie, then that means
user is logged in. However, after logout, a techie user can create a idToken with dummy value. In that case,
still my application shows secure pages(since the idToken is present in browser cookie)

How to mitigate these issues?

 

Thanks

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by aanchal-sikka

Here are some additional steps you can take to mitigate the issues you've described:

1. Token Expiration and Refresh: Implement token expiration and refresh mechanisms. This involves setting an expiration time for tokens (e.g., idToken, accessToken) and periodically refreshing them. When a token expires, the user will need to reauthenticate to obtain a new token.

2. Token Validation: Ensure that tokens are validated on the server side before granting access to sensitive resources. This includes verifying the signature, issuer, and expiration time of the token. Do not solely rely on the presence of a token in the cookie to determine authentication status. Implement AuthCheckerServlet as described on https://experienceleague.adobe.com/docs/experience-manager-dispatcher/using/configuring/permissions-cache.html?lang=en. The Servlet should validate the token, before providing access

3. Revocation: Implement token revocation mechanisms to invalidate tokens when a user logs out or their session expires. This can be achieved by maintaining a blacklist of revoked tokens on the server side.

4. Use HTTPS: Ensure that your application is served over HTTPS to encrypt the communication between the client and server, reducing the risk of man-in-the-middle attacks.

5. Secure Token Storage: Store tokens securely on the client side using techniques such as HttpOnly and Secure flags, as you've already done. Additionally, consider encrypting sensitive token data stored on the client side.

 

 

 

1 reply

aanchal-sikka
Community Advisor
aanchal-sikkaCommunity AdvisorAccepted solution
Community Advisor
February 18, 2024

Here are some additional steps you can take to mitigate the issues you've described:

1. Token Expiration and Refresh: Implement token expiration and refresh mechanisms. This involves setting an expiration time for tokens (e.g., idToken, accessToken) and periodically refreshing them. When a token expires, the user will need to reauthenticate to obtain a new token.

2. Token Validation: Ensure that tokens are validated on the server side before granting access to sensitive resources. This includes verifying the signature, issuer, and expiration time of the token. Do not solely rely on the presence of a token in the cookie to determine authentication status. Implement AuthCheckerServlet as described on https://experienceleague.adobe.com/docs/experience-manager-dispatcher/using/configuring/permissions-cache.html?lang=en. The Servlet should validate the token, before providing access

3. Revocation: Implement token revocation mechanisms to invalidate tokens when a user logs out or their session expires. This can be achieved by maintaining a blacklist of revoked tokens on the server side.

4. Use HTTPS: Ensure that your application is served over HTTPS to encrypt the communication between the client and server, reducing the risk of man-in-the-middle attacks.

5. Secure Token Storage: Store tokens securely on the client side using techniques such as HttpOnly and Secure flags, as you've already done. Additionally, consider encrypting sensitive token data stored on the client side.

 

 

 

Aanchal Sikka
    Terms & ConditionsAccessibility statement

    Loading footer...