S
S
sonic19952018-01-02 01:41:49
PHP
sonic1995, 2018-01-02 01:41:49

Cookie signature hash to check integrity. It makes sense?

Hello community! I would like to know if it makes sense to sign cookies with a hash to check them for integrity (not changing the values ​​by the user themselves)? First of all, I understand that I should not store any sensitive data in cookies and use sessions instead. This is exactly what I do. But still, I don't like it when the user can modify even not so important data.
Right now I'm using this scheme: suppose we have cookies for:

  • PHPSESSID
  • site_lang
  • recently_viewed

Now when I update (add/delete/edit) a cookie value, I calculate the hash for the cookie with a key say cookie_hash and a value like md5(serialize ($_COOKIE(without PHPSESSID)) + $secret) the PHPSESSID key to calculate and validate I don't use the hash because it is not managed by the CookieManager class (let's say the class name for managing cookies) and the value can be updated at any time to prevent session fixation...
My only concern is that if some third party package\class\library installs some kind of cookie, bypassing my CookieManager, of course. he will break the hash. Is it even worth it to do so?
Perhaps the CookieManager should keep a record of the values ​​it sets and only read/verify the hash for them?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
S
Stalker_RED, 2018-01-02
@sonic1995

Don't you feel like you're reinventing JWT ?

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question