== Recommended Secure Coding Practices

Cookies should only be used to manage the user session. The best practice is to keep all user-related information server-side and link them to the user session, never sending them to the client. In a very few corner cases, cookies can be used for non-sensitive information that need to live longer than the user session.


Do not try to encode sensitive information in a non human-readable format before writing them in a cookie. The encoding can be reverted and the original information will be exposed.


Using cookies only for session IDs doesn't make them secure. Follow https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Cookies[OWASP best practices] when you configure your cookies.


As a side note, every information read from a cookie should be https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet[Sanitized].
