How can you design software resistant to cookie poisoning attacks?

2 Encrypt and sign cookies

Another way to prevent cookie poisoning is to encrypt and sign the cookies, which makes them unreadable and verifiable by the server. Encryption means transforming the cookie data into a secret code that can only be decoded with a key. Signing means adding a signature to the cookie data that can only be generated and validated with a secret key. This way, even if an attacker can access the cookie, they cannot modify or forge it without knowing the keys.

To encrypt and sign cookies, you need to use a cryptographic algorithm and a secret key. For example, in Node.js, you can use the cookie-session middleware with the keys option:

const cookieSession = require("cookie-session");
app.use(cookieSession({
  name: "session",
  keys: ["secret_key_1", "secret_key_2"], // use different keys for encryption and signing
  maxAge: 24 * 60 * 60 * 1000 // one day
}));        

3 Validate and sanitize inputs

A third way to prevent cookie poisoning is to validate and sanitize the inputs that affect the cookie values, such as user input, query parameters, or headers. Validation means checking if the input meets certain criteria, such as format, length, or range. Sanitization means removing or replacing any potentially harmful characters or elements from the input, such as scripts, tags, or symbols. This way, you can prevent injection attacks that can alter the cookie data or execute malicious code.

To validate and sanitize inputs, you need to use a library or a framework that provides these features. For example, in Python, you can use the WTForms library with the validators and filters options:

from wtforms import Form, StringField, validators, filters
class LoginForm(Form):
  username = StringField("Username", [
    validators.Length(min=4, max=25), # validate length
    filters.strip() # sanitize whitespace
  ])
  password = StringField("Password", [
    validators.DataRequired(), # validate presence
    filters.none() # sanitize nothing
  ])