I am not sure if I should post this on it security or / stackoverflow because I am concerned about security and performance.
I am trying to find a reliable source for cookie management. I read though OWASP so i roughly know what can be dangerous.
But I need to authenticate my users with cookies. Is there a complete step by step guide?
What I did:
generate a random and unique string.
associate the random string with a user in my cache rndstring -> user
create a secure and signed cookie. value= hash(rndstring+secret)|rndstring
if the user comes back, I check if the hashes matches, and if the rndstring is in my cache.
if yes get the user.
I think my approach is flawed because I made it by myself.
Another problem would be that I safe the user object from the db in my cache. If the user updates his profile I would also have to update the cache.
I am using java with the play2 framework + mongoDB.
What resources can you recommend me?