Exploiting encrypted cookies for fun and profit
Introduction
Developers often incorrectly use encryption in an attempt to provide authenticity. For example, a RESTful application may mistakenly use an encrypted cookie to embed the current user's identity.
The mistake is that encryption can only be used to keep a secret while signing is used to verify authenticity of a message. In this post, I will explain and provide an example of why encryption is not a guarantee of authenticity.
If you just want to see code, feel free to skip to the end which has a sample Java application that demonstrates the exploit.
Encrypted Cookies (whoops)
Assume we…