<filename>Library/Articles/e17caf9a-36ff-486f-8329-7c238a7ef13d.json
{
  "TeamMentor_Article": {
    "$": {
      "Metadata_Hash": "0",
      "Content_Hash": "0"
    },
    "Metadata": [
      {
        "Id": [
          "e17caf9a-36ff-486f-8329-7c238a7ef13d"
        ],
        "Id_History": [
          "e17caf9a-36ff-486f-8329-7c238a7ef13d,1505cffd-525d-4b45-bd96-1e14e5ea1c0b,"
        ],
        "Library_Id": [
          "be5273b1-d682-4361-99d9-6234f2d47eb7"
        ],
        "Title": [
          "Sensitive Data Is Not Stored in Persistent Cookies"
        ],
        "Category": [
          "Session Management"
        ],
        "Phase": [
          "Implementation"
        ],
        "Technology": [
          "Technology Independent"
        ],
        "Type": [
          "Checklist Item"
        ],
        "DirectLink": [
          "Sensitive Data Is Not Stored in Persistent Cookies"
        ],
        "Author": [
          ""
        ],
        "Priority": [
          ""
        ],
        "Status": [
          ""
        ]
      }
    ],
    "Content": [
      {
        "$": {
          "Sanitized": "false",
          "DataType": "wikitext"
        },
        "Data": [
          "==Applies To==\n\n* Web Applications\n\n==What to Check For==\n\nMake sure that sensitive data is not stored in persistent cookies. \n\n==Why==\n\nData stored in persistent cookies may be recovered by an attacker, if the attacker gets access to where the cookies are stored. Usually, this attack scenario means an attacker gaining physical access to the victim's computer and recovering all the cookies from it. At that point, any sensitive data in those cookies comes into the possession of the attacker. It is therefore not recommended to store sensitive data in persistent cookies. The most common type of sensitive data that is stored in persistent cookies is an authentication token or a session ID, which is used to keep a user logged on for an extended period of time. If this functionality is absolutely required, then storing such sensitive information in persistent cookies cannot be avoided. Overall, it is recommended not to implement that functionality and not to store any sensitive information in persistent cookies. \n\n==How to Check==\n\nTo make sure that sensitive data is not stored in persistent cookies: \n\n# **Identify all cookies used by the application.** Search application code for references to setcookie. This should help find all the cookies created by the application.\n# **Find code that handles sensitive cookies.** Examine code that handles each cookie and see if it stores sensitive information in the cookie.\n# **Make sure that sensitive cookies aren't persistent.** Review all code that handles sensitive cookies. Make sure that the expire property of sensitive cookies is never set, because that makes them persistent.\n\n==How to Fix==\n\nTo prevent storing sensitive data in persistent cookies:\n\n# **Identify all cookies used by the application.** Search application code for references to setcookie. This should help find all the cookies created by the application.\n# **Find code that handles sensitive cookies.** Examine code that handles each cookie and see if it stores sensitive information in the cookie.\n# **Don't make sensitive cookies persistent.** Review all code that handles sensitive cookies. Make sure that the expire property of sensitive cookies is never set, because that makes them persistent. Remove code that sets the expire property of sensitive cookies, if such code exists."
        ]
      }
    ]
  }
}