Cookie and session encryption? I have used cookies and sessions to log on to the front, back, and back ends, but I put them in directly. I read them and read them directly. Recently, I heard from my teacher about cookie and session encryption, I don't know what orthodox practices are like now? Is both cookie and session encrypted?
In addition, encryption does not directly use md5, but is complicated. is md5 insecure? why not use md5 directly?
Reply to discussion (solution)
Cookies can be encrypted, but the encrypted data cannot be used by js.
If the decryption function of the js version is provided, encryption is meaningless.
The session does not need to be encrypted because it is stored on the server.
If you cannot guarantee the security of your own server, simply do not do web development.
MD5 is not encrypted, but an index
Only reversible encoding algorithms can be called encryption.
Cookies can be encrypted, but the encrypted data cannot be used by js.
If the decryption function of the js version is provided, encryption is meaningless.
The session does not need to be encrypted because it is stored on the server.
If you cannot guarantee the security of your own server, simply do not do web development.
MD5 is not encrypted, but an index
Only reversible encoding algorithms can be called encryption.
Can this be said, as long as I use cookies, I will encrypt them? Previously, I saw that the teacher was doing user login and remembering the password for encryption.
Cookies can be encrypted, but the encrypted data cannot be used by js.
If the decryption function of the js version is provided, encryption is meaningless.
The session does not need to be encrypted because it is stored on the server.
If you cannot guarantee the security of your own server, simply do not do web development.
MD5 is not encrypted, but an index
Only reversible encoding algorithms can be called encryption.
Can this be said, as long as I use cookies, I will encrypt them? Previously, I saw that the teacher was doing user login and remembering the password for encryption.
Some sensitive data is stored in the local cookie for security reasons, so there are a lot of encryption methods to do a verification when reading them...
It is inappropriate to store sensitive data in cookies because cookie data is repeatedly transmitted over the network.
Even if the password is added, you cannot eliminate the possibility of leaks during multiple transmission.
It is best not to encrypt in cookies
It is inappropriate to store sensitive data in cookies because cookie data is repeatedly transmitted over the network.
Even if the password is added, you cannot eliminate the possibility of leaks during multiple transmission.
What is the conclusion?
Do not store sensitive data into cookies, so do not encrypt them?
For example, if you log on automatically and remember the password, isn't it a common technology?
Remember the password. do you really remember the password?
No password exists at the root of the cookie!