Exercise 14

1. What are cookies and how are they used to improve security?

Cookie is information that a Web site puts on your hard disk so that it can remember something about you at a later time. (More technically, it is information for future use that is stored by the server on the client side of a client/server communication.) Typically, a cookie records your preferences when using a particular site. Using the Web's Hypertext Transfer Protocol (HTTP), each request for a Web page is independent of all other requests. For this reason, the Web page server has no memory of what pages it has sent to a user previously or anything about your previous visits. A cookie is a mechanism that allows the server to store its own information about a user on the user's own computer. You can view the cookies that have been stored on your hard disk (although the content stored in each cookie may not make much sense to you). The location of the cookies depends on the browser. Internet Explorer stores each cookie as a separate file under a Windows subdirectory. Netscape stores all cookies in a single cookies.txt fle. Opera stores them in a single cookies.dat file. (Techtarget, 2009)

Cookies are used to improve security, for example, a cookie contains a random chain (session identification), which is unique and difficult to decipher, and valid only for a given period of time. Only the server should be able to associate the user's preferences with the session identifier. Thus, when the session cookie expires, it becomes useless and should not contain any information relating to the user. (Kioskea, 2009)

2. Can the use of cookies be a security risk?

Yes, they can, for example, If the cookie contains direct user information, and its lifespan don't be as close as possible to the duration of the user's session. On the other hand, the data stored in the cookie is sent to the server, to the database where the user entered his data.
Thus, the cookie can be a potential security risk when contain user information.

References:

Techtarget (2009). “Cookie”. Received 20th April, 2009 from URL -
http://searchsoftwarequality.techtarget.com/sDefinition/0,,sid92_gci211838,00.html

Kioskea (2009). “Cookies”. Received 20th April, 2009 from URL -
http://en.kioskea.net/contents/securite/cookies.php3