Question

I usually hang out in a community that uses a bulletin board software.

I was looking at what this software saves as cookie in my browser.

As you can see it saves 6 cookies. Amongst them, what I consider to be important for authentification are:

1. ngisessionhash: hash of the current session
2. ngipassword: hash (not the plain password probably) of the password
3. ngiuserid: user’s id

Those are my assumptions of course. I don’t know for sure if ngilastactivity and ngilastvisit are used for the same reason.

My question is: why use all these cookie for authentication? My guess would be that maybe generating a session hash would be to easy so using the hashedpassword and userid adds security but what about cookie spoofing? I’m basically leaving on the client all fundamental informations.

What do you think?

UPDATE #1

The contents of these cookies are what I think they contains. I’m not sure about it.
Of course if call a cookie ngivbpassword and contains an hash, my guess is hashedpassword. Probably it could be password+salt.

My main concern is about these solution giving to much information when under a cookie spoofing attack.

UPDATE #2
This question doesn’t want to criticize the way these specific software works but, thorugh these answers I want just to learn more about securing software in a web environment.

Answer 1

This happens because session and login cookies may have different lifecycles.

Imagine website with millions of users every day. The website won’t store your session for a year just to log you back the next time you get back.
They use login cookies for that.

These cookies are also called Remember-Me cookies.