Using Cookies for Web Session State - What are the pitfalls?

Question

Using in-process session state is evil when it comes to scaling web applications (does not play well with clusters, bombs out when server recycles).

Assuming you just need to keep a small amount of information in the session state, what is the downside of using encrypted cookie items for this purpose rather than specific state servers/db’s?

Obviously using cookies will create a small amount of network overhead, and clearly you operate under the assumption that cookies are enabled on the client browser/mobile device.

What other pitfalls can you see with approach?

Is this a good option for simple, scalable and robust sessions?

Answer 1

This is an excellent approach for simple, scalable, and robust sessions. Of course the quality of your crypto is important, and that is often something that often proves tricky to get right, but it's possible to do.

I disagree with some of the other posters:

Any replay attack that can be launched against an encrypted cookie value can be launched against a session key stored as a cookie. Use https if this matters.

Session data stored in a state server or database is also lost if the cookie is cleared; when the session key is lost the session can no longer be retrieved.

Answer 2

Another pitfall is that they can be stolen and replayed on your site.

BTW: Instead of storing some stuff in the cookie, you should also look at storing a key in the cookie and using something like memcached (memcached works across server farms).