title: Javascript - Security of document.cookie
body: <p>I have an application that creates Cloud Front cookies using the AWS CloudFront API and Lambda. Unfortunately I can't set cookies using the standard HTTP response format and have to use document.cookie to set cookies to my users' browsers from an HTML page. The cookie includes a policy to grant access to content, a signature to confirm authenticity of the cookie, and key-pair ID. A back-end script on Lambda creates the cookie and sends it to the requester as a payload, which then gets passed as a variable to document.cookie.</p>
  
  <p>I've read a lot about securing cookies (HttpOnly, session cookie, secure flag, etc.) and I'm trying to understand the security risks of document.cookie. Is there a difference between setting cookies through Http response and document.cookie in the context of security? Would it be possible for a malicious user to insert their own policy into the cookie as the cookie is created client-side, giving them access to other content despite the page being read only?</p>
  
  <p>Here's some code for reference:</p>
  
  <pre><code>payload = data["Payload"]
  jsoned = JSON.parse(payload)
  cookie = jsoned['cookie']
  redirectUrl = jsoned['redirectUrl']
  
  document.cookie = 'CloudFront-Policy' + "=" + cookie['CloudFront-Policy'] + "; path=/mydirectory";
  document.cookie = 'CloudFront-Key-Pair-Id' + "=" + cookie['CloudFront-Key-Pair-Id'] + "; path=/mydirectory"
  document.cookie = 'CloudFront-Signature' + "=" + cookie['CloudFront-Signature'] + "; path=/mydirectory"
  </code></pre>
  
  <p>My first time posting to this. Thanks for the help in advance. </p>
  
  <p>-Ken</p>