4 ms·
The cookie contents can be changed only if you know the secret config.
by ddorian43 2y ago
The cookie contents can be changed only if you know the secret config.
- shakna 2y agoOr if you can bruteforce the secret, or if there's a vulnerability in the secret, or if... You're relying on the fact that the cryptography will be impregnable, rather than adopting an actual security posture. Do not trust the data you send to a user, to remain secure.
- ddorian43 2y agoAnd you're relying on security through obscurity.
- shakna 2y agoNo. It's relying on both cryptography, and the inaccessiblity of information. Which is a tried, practiced, and often federally mandated, method of security. Controlling who has access to information is sorta security 101. Don't dump your database to the Internet. Security through obscurity is allowing REST commands to the /totallysecretaddress/neverleaked/ URI.