Take the 2-minute tour ×  I'm working on a small side project
using CGI and Python (scalability is not an issue and it needs
to be a VERY simple system.)  I was thinking of implementing
authentication using cookies, and was wondering if there were
any established best practices.  When the user successfully
authenticates, I want to use cookies to figure out who is logged
on. What, according to the best practices, should be stored in
such a cookie?  share|improve this question add comment  2
Answers  up vote 7 down vote accepted  Best case: A single ID
that relates to all the other information you need, which in
turn is stored in a database.  There are times when it makes
sense to put some other information in there, but they are rare.
You always need to ask yourself why, at least five times.  SSL
will protect your users from session hijacking but, even then,
never store unencrypted sensitive information in a cookie. It
is, essentially, stored in plain text on the harddrive.
Finally, and most importantly, prot