The web site www.widget.com requires users to supply a user name and a password.
ID: 3545342 • Letter: T
Question
The web site
www.widget.com requires users to supply a user name and a password. This information is encoded
into a cookie and sent back to the browser. Whenever the user connects to the Web server, the
cookie is sent. This means that the user need only supply a password at the beginning of the session.
Whenever the server requests reauthentication, the client simply sends the cookie. The name of the
cookie is identif.
(a) Assume that the password is kept in the clear in the cookie. What should the settings of the
secure and expires ?elds be, and why?
(b) Assume that the name and password are hashed, and that the hash is stored in the cookie. What
information must the server store to determine the user name associated with the cookie?
(c) Is the cookie storing state or acting as an authentication token, or both? Justify your answer.
Explanation / Answer
(a)Cookie is a small piece of data sent from a website and stored in a user's web browser while the user is browsing that website. Every time the user loads the website, the browser sends the cookie back to the server to notify the website of the user's previous activity.
(b)Cookies can also store passwords and forms a user has previously entered, such as a credit card number or an address. When a user accesses a website with a cookie function for the first time, a cookie is sent from server to the browser and stored with the browser in the local computer. Later when that user goes back to the same website, the website will recognize the user because of the stored cookie with the user's information.
(c)Perhaps most importantly, authentication cookies are the most common method used by web servers to know whether the user is logged in or not, and which account they are logged in with. Without such a mechanism, the site would not know whether to send a page containing sensitive information, or require the user to authenticate themselves by logging in.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.