1

A short question this time:

How much of a security risk is it when an third party gets access to WordPress auth cookie?

Can they for example simply copy the cookie and "be" logged in as the user who was the original cookie owner?

I ask this because i'm planning on passing the auth cookie value between different servers.

Improve this question

1 Answer 1

Reset to default
2

Can they for example simply copy the cookie and "be" logged in as the user who was the original cookie owner?

Yes! with the cookie they basically have your login session. You do not want 3rd parties to get the cookie. Keep in mind there is more than 1 cookie, for frontend and for backend.

I ask this because i'm planning on passing the auth cookie value between different servers.

I would advise against sending the actual cookie across servers. This sounds like an XY problem question, where instead of asking how to solve problem X, you asked how to implement or fix solution Y. There are better ways to handle users across multiple servers ( some of which are a part of how cookies work ), but it would depend on what you're doing that necessitates this, you'd need to ask a new question ( possibly on another stack )

Improve this answer
3
  • Cheers Tom, good to know it is no more than copy & paste, now i can abort the idea of transferring auth cookie values. But indeed enough alternatives, i'm now thinking about transferring a unique key which expires within 30 seconds and binding the key to the ip address. It would have been nice if all that could have been avoided by simple using the auth cookie, but everything needs to be at least secure.
    – Tinus Tate
    Feb 11, 2019 at 21:09
  • It's not clear what the problem you're trying to solve is. You may not need to do any of this at all, it might be possible just by changing the cookie itself, but since you provided zero details or context I can only speculate. Eitherway all this unique code is basically "roll your own crypto", which is a fast track to broken security
    – Tom J Nowell ♦
    Feb 11, 2019 at 21:22
  • No problemo, it indeed wasn't part of my question, i just wanted to know how secure wordpress auth cookie was, so i could make a decision on which way to go. In my normal day job i'm dabbling a bit on the security subject, which i sometimes borrow for my personal projects. Of course security is an important subject, but can lead to over complicated and over engineered solutions. Keeping it simple makes it clear what and where the risks are.
    – Tinus Tate
    Feb 11, 2019 at 21:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.