I'm wondering the best way to implement cookies to my site. I would like a user to be able to edit a given post based off a cookie that I set at the time the post is created.

I'm using Angular to set the cookie. ie:

var favoriteCookie = $cookies.myFavorite;
$cookies.myFavorite = 'oatmeal';

(per the Angular tutorial for $cookies).

My question is more at the core of how to use cookies. Wouldn't it be easy for a user to set the cookie using the console? ie:

 document.cookie = 'key=value';

And get access to a post for editing? Perhaps I should be creating a unique id to use as a cookie that I then check for when the actual creator visits the page? If so, how might I go about this to best ensure only the actual creator of the post has access to editing?

I'm wondering the best way to implement cookies to my site. I would like a user to be able to edit a given post based off a cookie that I set at the time the post is created.

I'm using Angular to set the cookie. ie:

var favoriteCookie = $cookies.myFavorite;
$cookies.myFavorite = 'oatmeal';

(per the Angular tutorial for $cookies).

My question is more at the core of how to use cookies. Wouldn't it be easy for a user to set the cookie using the console? ie:

 document.cookie = 'key=value';

And get access to a post for editing? Perhaps I should be creating a unique id to use as a cookie that I then check for when the actual creator visits the page? If so, how might I go about this to best ensure only the actual creator of the post has access to editing?

• javascript
• angularjs
• cookies

• Are you handle sessions? – MelgoV Commented May 13, 2015 at 0:47

1 Answer 1

You can restrict JavaScript manipulation by setting the HttpOnly flag in the cookie on a response. The console won't be able to set it programatically.