4 ms·
"Also cookies are not cryptographically signed and thus easily forgeable by the client/browser." My Apache webby thingies quite happily dole out encrypted cook
by gerdesj 1y ago
"Also cookies are not cryptographically signed and thus easily forgeable by the client/browser."
My Apache webby thingies quite happily dole out encrypted cookies:
https://httpd.apache.org/docs/2.4/mod/mod_session_crypto.html https://httpd.apache.org/docs/2.4/mod/mod_session_crypto.htm...
Your notes on cross site issues are also described there.
JWTs are mutually shared secret passable with nobs on - you can store loads of data in them. Cookies are more one shot and one piece of data.
- formerly_proven 1y agoEncryption generally doesn’t provide authentication, so I wouldn’t be surprised if that Apache module allows a user to flip is_admin=0 to 1 because the encryption is sufficiently malleable to do that. Especially because that page mentions 3DES.