4

I need to implement a simple remember me option in a java servlet with cookies, without using any advanced framework.

First, at login, I create the cookie and send it in response to the browser (client). The value to be stored in the cookie is just a simple hash from username + password.

How should I manage the incoming request from the browser, sending the cookie? My approach is to check between registered users if there is any user that has the hash from username + password equal to the value in the cookie? Is this approach correct?

Also, I did not understand exactly what is the mechanism of the expiration date. Does the browser delete the cookie when it is expired, it not, how do I check if the cookie is expired?

Alina Danila
  • 1,683
  • 1
  • 24
  • 60

1 Answers1

4

As long as you're not using HTTPS the method you suggest is highly insecure. I would suggest to generate some sort of session token (e.g. use java.util.UUID.randomUUID()) and set this as cookie and store it somewhere on the server side so you later can identify the user associated with this session id in the cookie.

This gives you the opportunity to reset a certain session cookie if you think there's some fraud happening and there's no direct relation between the user name/password and the cookie id you use. But note: this method is still vulnerable to a man-in-the-middle attack.

Concerning the expiration: yes the cookie becomes invalid and might get deleted by the browser if it is expired. But you can set the cookie to something in the year 3000, so it lives forever.

HefferWolf
  • 3,894
  • 1
  • 23
  • 29