Application authentication security using browser cookies

user_19181669 0
Viewed 80

I am building a social media application using nodejs for backend and considering different ways of establishing a "Keep me logged in" functionality.

I have read about the dangers of storing user authentication data in cookies, so I am looking for tricks to ensure user security.

I am considering generating a random token using jsonwebtoken, which encodes a userid and the users IP address. When the user logs into the application the cookie stored in the browser is decoded, if IP address stored in the cookie matches the current IP address of the device, the user logs in automatically.

Would this be safe enough? If not, what are more secure ways of achieving "Keep me logged in" functionality?

websecurity jwt session-cookies node.js authentication
2 Answers

Depending what are your security requirements, http cookie may not be the best option for storing client-side session/token information as it is server readable, expirable, prone to accidental cleaning and so on. Consider using browser's localStorage instead.

If you need more protection to "Keep me logged in" feature, against other specific vulnerabilities e.g. spoofing in IoT applications from another device, you might look for browser fingerprinting.

user_180931240

This would not be safe enough.

A session-hijack might happen if an attacker achieves a userID and his IP address. He can then proceed to create a spoofed cookie made by encoding the victim's userID and the relevant IP address, thus hijacking the victim's session.

For your second part of the question, a more secure way to achieve "Keep me logged in" functionality is to implement a session management with access control and authentication & authorization mechanism.

I would also suggest reading Session Management Cheat Sheet by OWASP.

user_27289250
Related