Ram based Cookies

[Mark]

We use cookies to maintain some state information about a users session.
They are not file based due to the fact that we don't specify a expiration
date. They go away when the session ends. I know it's possible to modify a
file based cookie. However, what would it take for a hacker that did not
have access to our web server to modify the value of a ram based client
cookie that we're creating below? I'm not concerned about someone reading
what is in the cookie - I'm nervous about them being able to modify the
cookie value.

Thanks in advance.
Mark

HttpCookie ckCookie = Request.Cookies[strCookieName];
if (ckCookie == null)
{
ckCookie = new HttpCookie(strC ookieName, strCookieValue) ;
Response.Cookie s.Add(ckCookie) ;
}
else
{
Response.Cookie s[strCookieName].Value = strCookieValue;
}

[Steve Drake]

I would never assume it cannot be edit, cookie are sent in the HTTP headers
so you could intercept this and change the values.

You could HASH the cookie.

Steve

Steve
"Mark" <fi******@idono tlikejunkmail.u mn.edu> wrote in message
news:ec******** *****@tk2msftng p13.phx.gbl...

We use cookies to maintain some state information about a users session.
They are not file based due to the fact that we don't specify a expiration
date. They go away when the session ends. I know it's possible to modify a file based cookie. However, what would it take for a hacker that did not
have access to our web server to modify the value of a ram based client
cookie that we're creating below? I'm not concerned about someone reading
what is in the cookie - I'm nervous about them being able to modify the
cookie value.

Thanks in advance.
Mark

HttpCookie ckCookie = Request.Cookies[strCookieName];
if (ckCookie == null)
{
ckCookie = new HttpCookie(strC ookieName, strCookieValue) ;
Response.Cookie s.Add(ckCookie) ;
}
else
{
Response.Cookie s[strCookieName].Value = strCookieValue;
}

[Mark]

Great idea. A quick code sample, or pseduo code for both hashing and
unhashing would be deeply appreciated.

Mark

"Steve Drake" <St***@NOSPAMDr akey.co.uk> wrote in message
news:Om******** ******@tk2msftn gp13.phx.gbl...

I would never assume it cannot be edit, cookie are sent in the HTTP headers so you could intercept this and change the values.

You could HASH the cookie.

Steve

Steve
"Mark" <fi******@idono tlikejunkmail.u mn.edu> wrote in message
news:ec******** *****@tk2msftng p13.phx.gbl...

We use cookies to maintain some state information about a users session.
They are not file based due to the fact that we don't specify a expiration date. They go away when the session ends. I know it's possible to modify

a

file based cookie. However, what would it take for a hacker that did

not have access to our web server to modify the value of a ram based client
cookie that we're creating below? I'm not concerned about someone reading what is in the cookie - I'm nervous about them being able to modify the
cookie value.

Thanks in advance.
Mark

HttpCookie ckCookie = Request.Cookies[strCookieName];
if (ckCookie == null)
{
ckCookie = new HttpCookie(strC ookieName, strCookieValue) ;
Response.Cookie s.Add(ckCookie) ;
}
else
{
Response.Cookie s[strCookieName].Value = strCookieValue;
}

[Patrice]

Safe enough AFAIK. Of course you could always take an hexadecimal memory
editor, locate the cookie somewhere in memory and change its value but it's
probably beyond most people even hackers skills.

You could also just avoid storing things that you seems to consider as
"secret" client side (for example you could store a "handle" to this info,
if the "handle" is changed, there is no info anyway on the other side - this
is basically what session variables are ? Can't you use this ?).

Patrice

"Mark" <fi******@idono tlikejunkmail.u mn.edu> a écrit dans le message de
news:ec******** *****@tk2msftng p13.phx.gbl...

We use cookies to maintain some state information about a users session.
They are not file based due to the fact that we don't specify a expiration
date. They go away when the session ends. I know it's possible to modify a file based cookie. However, what would it take for a hacker that did not
have access to our web server to modify the value of a ram based client
cookie that we're creating below? I'm not concerned about someone reading
what is in the cookie - I'm nervous about them being able to modify the
cookie value.

Thanks in advance.
Mark

HttpCookie ckCookie = Request.Cookies[strCookieName];
if (ckCookie == null)
{
ckCookie = new HttpCookie(strC ookieName, strCookieValue) ;
Response.Cookie s.Add(ckCookie) ;
}
else
{
Response.Cookie s[strCookieName].Value = strCookieValue;
}

[Peter O'Reilly]

Another solution is to use SSL.
--
Peter O'Reilly

[Mark]

Ah, good point. Let's assume I'm using SSL. What would it take for an
authenticated user sitting at their client browser to modify their clear
text ram based cookie values?

Thanks again.
Mark

"Peter O'Reilly" <Pe***********@ timeinc.com!N!O !.S!P!AM!> wrote in message
news:uh******** ******@TK2MSFTN GP11.phx.gbl...

Another solution is to use SSL.
--
Peter O'Reilly

[Steve Drake]

You create a NEW cookie, base it on the vals from your non editable cookie,
this new cookie is a sort of encrypted version of the non editable cookie,
in your server code, you REGEN this cookie from the non editable value, if
it doesent match, you asume the cookie has change.

This is sort of like a checksum.

I dont have a code sample, yet, but I do need todo this sort of thing soon.
Steve

you create a hash some sort of hash with some user info + the cookie name +
the cookie valiue
"Mark" <fi******@idono tlikejunkmail.u mn.edu> wrote in message
news:#b******** *****@TK2MSFTNG P10.phx.gbl...

Great idea. A quick code sample, or pseduo code for both hashing and
unhashing would be deeply appreciated.

Mark

"Steve Drake" <St***@NOSPAMDr akey.co.uk> wrote in message
news:Om******** ******@tk2msftn gp13.phx.gbl...

I would never assume it cannot be edit, cookie are sent in the HTTP

headers

so you could intercept this and change the values.

You could HASH the cookie.

Steve

Steve
"Mark" <fi******@idono tlikejunkmail.u mn.edu> wrote in message
news:ec******** *****@tk2msftng p13.phx.gbl...

We use cookies to maintain some state information about a users session. They are not file based due to the fact that we don't specify a expiration date. They go away when the session ends. I know it's possible to modify

a

file based cookie. However, what would it take for a hacker that did

not have access to our web server to modify the value of a ram based client cookie that we're creating below? I'm not concerned about someone reading what is in the cookie - I'm nervous about them being able to modify the cookie value.

Thanks in advance.
Mark

HttpCookie ckCookie = Request.Cookies[strCookieName];
if (ckCookie == null)
{
ckCookie = new HttpCookie(strC ookieName, strCookieValue) ;
Response.Cookie s.Add(ckCookie) ;
}
else
{
Response.Cookie s[strCookieName].Value = strCookieValue;
}

[bruce barker]

ssl prevents hijacking (some other user see the data and pretending to be
them). ssl will in noway hinder the user hacking his own cookie. as client
script can access the cookie, a user can modify his cookie with a little
typing in the address bar (any browser), or if they can turn on a javascipt
console, its even easier.

-- bruce (sqlwork.com)
"Mark" <fi******@idono tlikejunkmail.u mn.edu> wrote in message
news:OO******** ******@TK2MSFTN GP09.phx.gbl...

Ah, good point. Let's assume I'm using SSL. What would it take for an
authenticated user sitting at their client browser to modify their clear
text ram based cookie values?

Thanks again.
Mark

"Peter O'Reilly" <Pe***********@ timeinc.com!N!O !.S!P!AM!> wrote in message
news:uh******** ******@TK2MSFTN GP11.phx.gbl...

Another solution is to use SSL.
--
Peter O'Reilly

[Mark]

Thanks Steve.

Correct me if I'm wrong but this essentially requires both the client and
the server to maintain this "value" that I'm passing in the cookie. To
regenerate the value on the server, and then compare it to the client
cookie, that means the server has to have a clue. :)

In my scenario, the whole point of passing the cookie is that I don't want
the server (session or otherwise) to have to regenerate the value. The
cookie maintains this information so the server doesn't have to.

Am I misreading your suggestion? Thanks again.

Mark
"Steve Drake" <St***@NOSPAMDr akey.co.uk> wrote in message
news:u3******** ******@TK2MSFTN GP11.phx.gbl...

You create a NEW cookie, base it on the vals from your non editable cookie, this new cookie is a sort of encrypted version of the non editable cookie,
in your server code, you REGEN this cookie from the non editable value, if
it doesent match, you asume the cookie has change.

This is sort of like a checksum.

I dont have a code sample, yet, but I do need todo this sort of thing soon.

Steve

you create a hash some sort of hash with some user info + the cookie name + the cookie valiue
"Mark" <fi******@idono tlikejunkmail.u mn.edu> wrote in message
news:#b******** *****@TK2MSFTNG P10.phx.gbl...

Great idea. A quick code sample, or pseduo code for both hashing and
unhashing would be deeply appreciated.

Mark

"Steve Drake" <St***@NOSPAMDr akey.co.uk> wrote in message
news:Om******** ******@tk2msftn gp13.phx.gbl...

I would never assume it cannot be edit, cookie are sent in the HTTP

headers

so you could intercept this and change the values.

You could HASH the cookie.

Steve

Steve
"Mark" <fi******@idono tlikejunkmail.u mn.edu> wrote in message
news:ec******** *****@tk2msftng p13.phx.gbl...
> We use cookies to maintain some state information about a users session. > They are not file based due to the fact that we don't specify a

expiration

> date. They go away when the session ends. I know it's possible to

modify

a
> file based cookie. However, what would it take for a hacker that

did

not

> have access to our web server to modify the value of a ram based

client > cookie that we're creating below? I'm not concerned about someone

reading

> what is in the cookie - I'm nervous about them being able to modify the > cookie value.
>
> Thanks in advance.
> Mark
>
> HttpCookie ckCookie = Request.Cookies[strCookieName];
> if (ckCookie == null)
> {
> ckCookie = new HttpCookie(strC ookieName, strCookieValue) ;
> Response.Cookie s.Add(ckCookie) ;
> }
> else
> {
> Response.Cookie s[strCookieName].Value = strCookieValue;
> }
>
>

[Peter O'Reilly]

"Mark" <fi******@idono tlikejunkmail.u mn.edu> wrote in message
news:OO******** ******@TK2MSFTN GP09.phx.gbl...

Ah, good point. Let's assume I'm using SSL. What would it take for an
authenticated user sitting at their client browser to modify their clear
text ram based cookie values?

Your original message mentioned worries of a hacker. Your example above
notes
an authenticated user. The way I see it, how the hacker managed to get past
authentication is the greater risk
and concern.

In other words, if the person authenticated is really the person intended to
use the application, I do not see how any of what is contained in their
cookie would be alarming as they are undoubtedly aware of their own social
security number, credit card number, application settings selected or
inputted, etc.

Encrypted or not, keep in mind though that the user may see what cookie is
being set, even if it's a session (memory resident) cookie, using such
browsers as Mozilla and having such cookie alert setting turned on.

If such security is really paramount, I would create a cookie containing an
encrypted id that points to the user's session information contained on the
server such as a database. This plus implementing SSL is about as stealth
as one can imagine.

--
Peter O'Reilly