What are the risks of storing a user password in a Cookie, when the connection is via https?
cookies, security
Solution
HTTPS just protects against a man-in-the-middle attack by encrypting the data that goes across the wire. The information would still be in plain text on the client. So anything on the client's computer can go through that cookie information and extract the pertinent information.
Problem
A Note I have a very good understanding of sessions and the theory of secure web-based authentication, etc., so please don't start with the basics, or give ambiguous answers. I am not looking for Best Practices, because I am aware of them. I am looking for the real risks behind them, that make the Best Practices what they are. I have read, and agree with the principals that nothing more than a Session identifier should be stored in a Cookie at any given time. The Story However... I've inherited a rusty old app that stores the Username, Password, and an additional ID, in a Cookie, which is checked throughout the site as verification/authorization. This site is always (can only be) accessed via HTTPS, and depending on your stance, is a "low-risk" website. The application, in its current state, cannot be re-written in such a way as to handle Sessions - to properly implement such a thing would require, essentially, re-writing the entire application. The Question When suggesting to the-powers-that-be that storing their user's IDs/Passwords in plaintext, in a Cookie, is an extremely bad idea, what real risks are involved, considering the connection is always initiated and manipulated via HTTPS? For example: is the only obvious way to compromise this information via Physical Access to the machine containing the Cookie? What other real risks exist?