What is the purpose of cookie encryption?
I was researching on internet security. When I reached at section Cookies, I happened to read that the values inside a cookie are generally stored only after encrypting them. But an encryption can be easily decrypted by someone who can tamper the cookies. Considering the fact that if we have tampered with the cookie, then whether it is encrypted or not, it is possible to access the session corresponding to that cookie. Then what is actually the purpose of encrypting the cookie?
If the encryption key is stored on the server, then only the server can decrypt the cookie, and only the server can make predictable changes to the cookie. An attacker can make changes to the cyphertext of the cookie, but they cannot know in advance what effect those changes will have. If the cookie additionally includes a message authentication code or other anti-tampering measure, then an attacker cannot make changes to an encrypted cookie without invalidating it.
Cookie Encryption also keeps the user and others on the same computer from being able to see what information is being stored. This permits the server to associate sensitive information with a user (eg. "log me in automatically" information), without needing to track the session server-side.
Cookie encryption does nothing to keep cookie-stealing attacks from being used to impersonate a user; to defend against that, other measures are needed.
Run the utility on one of the replicated servers. From a command line, specify the location of the key file you want to create. You must specify an absolute path name. For example:
UNIX: # /opt/pdwebrte/bin/cdsso_key_gen absolute_pathname_for_keyfile
Windows: MSDOS> C:Program FilesTivoliPDWebrteincdsso_key_gen absolute_pathname_for_keyfile
You can give the key file any appropriate name, such as /opt/pdwebrte/lib/wpi.key. Edit the plug-in configuration file. In the [failover] stanza, specify the keyfile location.[failover] failover-cookies-keyfile = absolute_pathname_for_keyfile Manually copy the key file to each of the remaining replicated servers. On each replicated server, edit the plug-in configuration file to supply the correct path name to failover-cookies-keyfile in the [failover] stanza.