A remember-me feature appears to put a recoverable password in a browser cookie. Is that harmful if the cookie is stored locally, and what should the site use instead?
Is storing a password in a remember-me cookie a security risk?
Asked by
Kivven.23
Answers
Yes. A cookie can be stolen or exposed, and a recoverable password gives an attacker the actual credential. That can be worse than losing a session token because people sometimes reuse passwords on other sites.
Encoding or encrypting the password in the cookie doesn't make this a good design. The application still has to recover it, so the credential remains at risk.
Reply to this answer
Use a randomly generated remember-me token instead. Put the token in the cookie and store a hash of it on the server, associated with the account. The server can check the presented token without keeping the password in the browser.
Give the token an expiration and a way to revoke it. Set the cookie to Secure and HttpOnly, choose an appropriate SameSite setting, and use HTTPS. A stolen token can still grant access, so it needs protection too.
Reply to this answer
Also check what the server does with passwords. For a typical login, it should store a salted password hash using a password hashing algorithm, not plaintext or a recoverable encrypted copy. That's separate from the remember-me token.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Kivven.23:
So the token is still sensitive, but revoking it doesn't require changing the password?
4m~notch_682:
Right. The server can invalidate that token separately, though an exposed password should be changed.