Which of the following should be stored in the cookie?
-
Session ID
-
Account Privileges
-
UserName
-
Password
To solve this question, the user needs to know what information is appropriate to store in a cookie.
Now, let's go through each option and explain why it is right or wrong:
A. Session ID: This option is appropriate to store in a cookie. A session ID is a unique identifier assigned to a user's session and is used to keep track of session state. Storing the session ID in a cookie allows the server to identify the user's session on subsequent requests.
B. Account Privileges: This option is not appropriate to store in a cookie. Storing account privileges in a cookie is a security risk because cookies can be easily intercepted and manipulated. Instead, account privileges should be stored on the server and checked on each request.
C. UserName: This option is appropriate to store in a cookie. Storing the username in a cookie can improve the user experience by allowing the website to remember the user's preferences and customize the user's experience.
D. Password: This option is not appropriate to store in a cookie. Storing passwords in cookies is a significant security risk because cookies can be easily intercepted and manipulated. Passwords should never be stored in cookies or any other client-side storage.
The Answer is: A and C
Only an opaque Session ID should be stored in a cookie — it's a random token that maps to server-side session state, and even if intercepted, reveals nothing about the user directly (and can be invalidated). Account Privileges, UserName, and Password must never be stored client-side in a cookie: privileges/roles should be looked up server-side per request (client-supplied privilege data is trivially forgeable), and username/password in a cookie would be exposed to theft via XSS, network sniffing (if unencrypted), or physical access to the browser, defeating the purpose of authentication. This is standard secure session-management guidance (OWASP).