Localight / LocalightWebService

Localism Clique Program
http://localism.github.io/LocalightDocs/#/
0 stars 0 forks source link

Bad generalized cookie names #594

Closed julianpoy closed 8 years ago

julianpoy commented 8 years ago

I noticed while perusing the software that bad cookie names are being used. For example, in the code for the createGift route, line 796:

//Success, Store the phone number and email in the cookies
$cookies.put("phone", $scope.gc.phoneNumber);
$cookies.put("email", $scope.gc.email);

These tokens are now sitewide. The bad thing about having such general naming, is that although their life is intended only for a single page navigation, it is now saved sitewide. When doing cookie operations on other pages, conflicts can be created without knowing.

torch2424 commented 8 years ago

@julianpoy do you suggest more obfuscated cookie names?

julianpoy commented 8 years ago

I suggest having cookie names such as createGift-sentPhone, which is very specific to the page and the item. You are welcome to make it whatever you see fit, I just believe it would be better if we are very very specific among a mess of cookies in the browser.

torch2424 commented 8 years ago

Fashow how about:

localight-createGift-sentPhone?

That way we know it's our site, the page, and the cookie name.

Is that a good naming convention?

Brand-Page-CookieName

torch2424 commented 8 years ago

Julian says brand is not needed, the reson why we want more specific is to avoid overriding.

So our cookie convention shall be:

Page-CookieName

julianpoy commented 8 years ago

:+1:

torch2424 commented 8 years ago

doing this in cookieName

torch2424 commented 8 years ago

I am going to convert the enter amount cookie (igosdmbmtv) with the amount we are spending to enterAmount-inputAmount. As by looking at the cookie it is obvious, and someone trying to cheat the system is only cheating themselves