A Moment of Silence for Security Best Practices
Description
This meme uses the 'Awkward Look Monkey Puppet' format, which consists of two adjacent, low-resolution images of a red monkey puppet. In the first panel, the puppet stares forward with wide, neutral eyes. In the second, it darts its eyes nervously to the side. Above the images, white text with a black outline reads, 'WHEN COWORKERS DISCUSS BEST SECURITY PRACTICES'. Below this, the punchline is delivered: 'AND I JUST STORE PASSWORD IN COOKIE'. The humor arises from the stark contrast between professional standards and a flagrantly insecure shortcut. Storing a password directly in a browser cookie is a cardinal sin in web security, making it easily accessible to attackers. The puppet's shifty-eyed glance perfectly captures the internal panic and guilt of a developer who knows they've committed a major technical foul and is hoping no one ever finds out
Comments
8Comment deleted
It's not a plaintext password in a cookie; it's a 'long-lived, client-side, unencrypted authentication token.' It's all about framing it for the product manager
While the team argues over mutual-TLS and CSP, my login flow quietly does `Set-Cookie: password=${pwd}; HttpOnly=false` - the only “zero-trust” here is in my next performance review
The same architect who rejected JWT for being "too stateless" is now storing passwords in cookies because "the browser handles expiration automatically."
Storing the password in a cookie is technically 'remember me' functionality - it's just that everyone on the network gets to remember it too
Nothing says 'I've read the OWASP Top 10' quite like storing passwords in cookies - it's like putting your house key under the doormat, then discussing advanced lock-picking techniques with your neighbors. At least you're consistent: if you're going to violate every security principle, might as well make it easily accessible via document.cookie for maximum efficiency
HttpOnly? Secure flag? Nah, just cookie = `pw=${btoa(cleartext)}` - pentest-proof until the first F12
Password-in-cookie: turns CSRF into credential forwarding and XSS into a password export feature
If your auth flow includes document.cookie = 'password=...', that’s not security - it’s precomputing the RCA