RE: Session security with cookies

["Martin O'Neal" <martin.oneal () corsaire com>]

> Encrypting or signing the data in the cookies is better 
> than not doing it...

In an ideal world:

- No data in cookies at all; all state should be held server side
- Session identifier not dependent on data at all; it should be truly
random and unique

Martin...



-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be 
considered a crucial phase in the development of any web application. What methodology should be followed? What tools 
can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------