When Security Best Practices Hit Too Close to Home
Description
A classic two-panel meme featuring the 'Monkey Puppet,' also known as the Awkward Look Monkey Puppet. In both panels, a brown puppet with large, expressive eyes is shown. In the first panel, it looks straight ahead. In the second, it darts its eyes nervously to the side. White, all-caps text is overlaid at the top: 'WHEN COWORKERS DISCUSS BEST SECURITY PRACTICES AND I JUST STORE PASSWORD IN COOKIE'. This meme captures the feeling of internal panic and guilt a developer might feel when their past or current questionable coding choices are the exact opposite of the best practices being discussed by their team. For experienced engineers, the humor lies in the extreme and obvious nature of the security flaw - storing a password in a cookie is a cardinal sin of web security - and the relatable awkwardness of knowing about a piece of terrible tech debt while trying to look professional
Comments
8Comment deleted
Storing a password in a cookie is the technical equivalent of writing your PIN on your credit card and then being surprised when your account is empty
AppSec is debating Argon2 parameters while the legacy portal quietly Base64-serializes the entire LoginDTO - including the password - into a cookie and calls it “stateless auth.”
The real security vulnerability here isn't the password in the cookie - it's admitting you still have a production system from 2003 where this was considered 'good enough' because 'we'll fix it in the next sprint' (narrator: they never fixed it)
Nothing says 'defense in depth' quite like storing authentication credentials in a client-side cookie with the same security posture as a Post-it note on your monitor. At least when the inevitable breach happens, you can tell the incident response team you were following the 'security through obscurity' pattern - specifically, obscuring the fact that you knew better from your coworkers during those security discussions
Storing the password in a cookie is basically declaring XSS your identity provider
They preach OWASP Top 10, I serve plaintext creds via cookie - because server-side sessions are for mortals with time to refactor
Security review: 45 minutes on OAuth2 + PKCE and token rotation; prod quietly ships Set-Cookie: password=admin; HttpOnly=false, because “remember me” and “it’s behind the VPN.”
Please no Comment deleted