Cookie Security Additions (#46)

Author: stilwellc

assets/images/OptInvsOptOutCookies.png

@@ -24,6 +24,7 @@ Cookies are mainly used for three purposes:
 * [Ingredients of a Cookie](#ingredients-of-a-cookie)
 * [The Perfect Cookie](#the-perfect-cookie)
 * [Elixir Phoenix Cookies](#elixir-phoenix-cookies)
+* [Data Security For Cookies](#data-security-for-cookies)
 
 ## Ingredients of a Cookie
 
@@ -132,8 +133,38 @@ Ooie-gooie and fresh out of the oven, perfectly golden brown. Here are some attr
 
 Ideally the cookie is also cryptographically signed or encrypted, but how that is done is typically up to the implementation.
 
+#### Signed Cookies
+
+Signed cookies are an alternative to signed URLs. Signed cookies protect access when separately signing tens or hundreds of URLs for each user isn't feasible in your application.
+Signed cookies let you do the following:
+
+* Authorize a user and provide them with a time-limited token for accessing your protected content (instead of signing each URL).
+* Scope the user's access to a specific URL prefix, such as https://media.example.com/videos/, and grant the authorized user access to protected content within that URL prefix only.
+* Keep your URLs and media manifests unchanged, simplifying your packaging pipeline and improving cacheability.
+
+##### Preventing Misuse of Signed Cookies
+
+If you specify the Domain parameter in a Set-Cookie header, specify the most precise value possible to reduce the potential for access by someone with the same root domain name. For example, app.example.com is preferable to example.com, especially when you don't control example.com. This helps prevent someone from accessing your content from www.example.com.
+To help prevent this type of attack, do the following:
+
+* Exclude the Expires and Max-Age cookie attributes, so that the Set-Cookie header creates a session cookie. Session cookies are automatically deleted when the user closes the browser, which reduces the possibility of someone getting unauthorized access to your content.
+* When possible, use a custom policy and include the IP address of the viewer.
+* Specify the shortest reasonable expiration time based on how long you want users to have access to your content.
+
+#### Encrypted Cookies
+
+Encrypting your cookies adds a layer of security since the browser client can not decrypt the data. With this, server side encryption makes cookies only meaningful to the intended back end application, and adds protection so that clients can not sniff the cookies.
+
+The encryption you use can be a one-way lookup of the cookie value. It is possible to use the encrypted value as the key to lookup data on the server. This means there is no need to take the cookie value and assume it is valid on the server. The web server can use the encrypted value to confirm what it knows about the client from the session. This one-way look up of encrypted cookie values adds an extra layer of protection.
+
 For instance, in the next section the Plug library gives you the ability to perform those actions within the `put_resp_cookie/4` function call. But if you store JSON Web Tokens (JWTs) as the value of your cookie, you can achieve similar signature results through the JWTs themselves.
 
+
+### Resources
+
+1. https://cloud.google.com/cdn/docs/using-signed-cookies#:~:text=Signed%20cookies%20give%20time%2Dlimited,t%20feasible%20in%20your%20application
+2. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-cookies.html
+
 ## Elixir Phoenix Cookies
 
 In the Phoenix Framework, you would use functionality found within the [Plug library](https://hexdocs.pm/plug/Plug.Conn.html#put_resp_cookie/4) to set a cookie.
@@ -159,4 +190,34 @@ conn
 )
 ```
 
+## Data Privacy For Cookies 
+
+### Storing personal information 
+While cookies by themselves can not dig and research your information, they do store personal information in at least 2 ways: form information and ad tracking. 
+
+Personal information is not generated by the cookies themselves, but are through user input via website registration pages, payments pages, and other online forms. To ensure proper security measures are in place this information should be encoded through limited interaction via SSL (secure socket layer) certified pages. 
+
+### Tracking User Behavior 
+
+For systems that use third party ad serving networks, such as Google's AdSense / AdWord pose additional privacy concerns. When leveraging ad serving platforms there is an impact to user privacy being there is no obvious consent given for such tracking. With the rapid evolution around cookie based ad services and tracking user behavior, it brings up the privacy concern of using default standards for cookies. 
+
+#### Opt Out Cookies
+Under an opt out scheme, consumers are notified via an alert or window when they load a website. The user must consent to the notice before they can navigate the site and any cookies are planted. At a minimum, the notice is to contain the following: disclosure of information gathering practices, the uses for this information, and policies for processing and disposing of this data.
+
+Opt-out cookies are essentially cookies used to avoid cookies. When a website creates an opt-out cookie in your browser folder, it enables you to block that same website from installing future cookies.With this, Opt Out cookies offer safeguards for user information, and help secure systems against potential security concerns regarding “hidden” cookies
+
+#### Opt In Cookies 
+Opt-in is the process that describes an affirmative action user takes to offer their consent for companies to use their data. Unticked checkboxes or buttons are the most common way in which you can implement opt-in mechanisms to obtain users’ consent.
+
+#### Which One To Use? 
+If you want to be legally compliant, it is safer to have both the options with opt-out as the default.
+
+<img src="../assets/images/OptInvsOptOutCookies.png" alt="OptInOptOutCookies" width="1000" height="450">
+
+### Resources
+
+1. https://allaboutcookies.org/privacy-issues-cookies
+2. https://www.cookielawinfo.com/opt-in-vs-opt-out/
+
+
 [**<- Previous Module: Elixir Security**](./5-elixir.livemd) || [**Next Module: Security Anti-Patterns ->**](./7-anti-patterns.livemd)