Cookie and session encryption?

Source: Internet
Author: User
Cookie and session encryption? I have used cookies and sessions to log on to the front, back, and back ends, but I put them in directly. I read them and read them directly. Recently, I heard from my teacher about cookie and session encryption, I don't know what orthodox practices are like now? Is both cookie and session encrypted?
In addition, encryption does not directly use md5, but is complicated. is md5 insecure? why not use md5 directly?


Reply to discussion (solution)

Cookies can be encrypted, but the encrypted data cannot be used by js.
If the decryption function of the js version is provided, encryption is meaningless.

The session does not need to be encrypted because it is stored on the server.
If you cannot guarantee the security of your own server, simply do not do web development.

MD5 is not encrypted, but an index
Only reversible encoding algorithms can be called encryption.

Cookies can be encrypted, but the encrypted data cannot be used by js.
If the decryption function of the js version is provided, encryption is meaningless.

The session does not need to be encrypted because it is stored on the server.
If you cannot guarantee the security of your own server, simply do not do web development.

MD5 is not encrypted, but an index
Only reversible encoding algorithms can be called encryption.

Can this be said, as long as I use cookies, I will encrypt them? Previously, I saw that the teacher was doing user login and remembering the password for encryption.


Cookies can be encrypted, but the encrypted data cannot be used by js.
If the decryption function of the js version is provided, encryption is meaningless.

The session does not need to be encrypted because it is stored on the server.
If you cannot guarantee the security of your own server, simply do not do web development.

MD5 is not encrypted, but an index
Only reversible encoding algorithms can be called encryption.

Can this be said, as long as I use cookies, I will encrypt them? Previously, I saw that the teacher was doing user login and remembering the password for encryption.

Some sensitive data is stored in the local cookie for security reasons, so there are a lot of encryption methods to do a verification when reading them...

It is inappropriate to store sensitive data in cookies because cookie data is repeatedly transmitted over the network.
Even if the password is added, you cannot eliminate the possibility of leaks during multiple transmission.

It is best not to encrypt in cookies

It is inappropriate to store sensitive data in cookies because cookie data is repeatedly transmitted over the network.
Even if the password is added, you cannot eliminate the possibility of leaks during multiple transmission.

What is the conclusion?
Do not store sensitive data into cookies, so do not encrypt them?

For example, if you log on automatically and remember the password, isn't it a common technology?

Remember the password. do you really remember the password?
No password exists at the root of the cookie!

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.