Re: Cookie Persistence

Quoting Andrew Cook <[email protected]>:

> Hi Ravi,
>
> Not sure which product you might be referring too, but it my experience,
> encrypting cookies on the ADC has almost negligible performance (sure,
> non-zero...) performance impact but provides an excellent focal point to not
> only ensure maximum application performance, and also consistent security -
> across a heterogeneous application environment.
>
> As Hamish point out, in theory you could/ should do it all at the individual
> servers, however (again in my experience over 10 years working in ADC
> environments) few organisations have the rigour or discipline across their
> multiple application towers to ensure consistent and robust security at the
> application level. And most ADCs have horsepower to burn...
>

I think a good summary of this is...

1. Cookies should never contain data, encrypted or not.
2. Encrypting cookies is low-overhead and MAY protect you against  
someone snooping.
3. Even encrypted cookies are vulnerable to being stolen. There's  
nothing in an encrypted cookie that would stop a 3rd party from  
stealing it.
4. So if you don't have the security measures in place already,  
encrypting the cookie will actually buy you nothing (UNLESS you're  
putting private data into the cookie, in which case WHY?).


> I'm sure that some might argue that there are exceptions to the rule, and
> they'd be right. However, on balance, the ADC is the simplest, most generic,
> and consistent place to enforce a number of security and application
> optimisation functions including cookie encryption.
>

Yes. If only to prevent accidental leakage. But cowboys who place  
private data INTO a cookie should still be sacked. Sadly I don't think  
they ever will be. Unfortunatley the very nature of trying to prevent  
the leakage is likely to result in more problems... People will  
continue to put data in cookies because they got away with it last  
week and you protected them. What are they going to do when their code  
has to run WITHOUT an ADC?

H

(Actually I'm probably maligning cowboys in the paragraph above.  
Perhaps we could call them politicians instead?)


----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki