# Why do you encrypt the cookie? **URL:** \ **Category:** Get Help\ **Tags:** authentication-sessions, sessions\ **Created:** [October 23, 2023, 7:56pm UTC](https://community.auth0.com/t/why-do-you-encrypt-the-cookie/119203 "2023-10-23T19:56:20Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![marc.bee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marc.bee/32/52285_2.png) [@marc.bee](https://community.auth0.com/u/marc.bee)\ **Post date:** [October 23, 2023, 7:56pm UTC](https://community.auth0.com/t/why-do-you-encrypt-the-cookie/119203/1 "2023-10-23T19:56:20Z")
The JWT token is [already signed](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-structure#jws-signature) and [does not require encrypted](https://jwt.io/introduction). The secure signing is enough to prevent tampering. Beyond that, there is no need to encrypt the cookie. - Browsers encrypt it while it is in transit (HTTPs), so it can’t be cloned. - Browsers also implement appropriate handling to prevent XSS, not that encryption would help that. > If for some reason the cookie is leaked/sniffed, contents cannot be inspected by anyone except the server the cookie was originally intended for. [Source](https://community.auth0.com/t/security-model-comparison-auth0-react-v-nextjs-auth0/99163) 1. What situation are you thinking of? The browser and https should do all of the lifting here. 2. Generally, leaking a JWT token is of no concern. What data inside of the JWT are you concerned about protecting? The downside of the encryption is that: 1. it bloats the size of the cookie. 2. It does (slightly) decrease performance of the server ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [October 26, 2023, 11:18pm UTC](https://community.auth0.com/t/why-do-you-encrypt-the-cookie/119203/4 "2023-10-26T23:18:18Z")
Hey there @marc.bee welcome to the community! While I’m no Next.js expert, encrypting the cookie is part of the [security model](https://github.com/auth0/nextjs-auth0#cookies-and-security). > [@marc.bee](#): > > Generally, leaking a JWT token is of no concern. What data inside of the JWT are you concerned about protecting? When you say JWT, are you referring to the ID token or access token? Leaking of an access token especially is definitely a security concern. > [@marc.bee](#): > > it bloats the size of the cookie. While true, you can opt to [_not_ store the ID token](https://auth0.github.io/nextjs-auth0/interfaces/config.SessionConfig.html#storeIDToken) as a means to cut down on overall size. ---
**Author:** ![marc.bee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marc.bee/32/52285_2.png) [@marc.bee](https://community.auth0.com/u/marc.bee)\ **Post date:** [November 7, 2023, 11:09pm UTC](https://community.auth0.com/t/why-do-you-encrypt-the-cookie/119203/5 "2023-11-07T23:09:31Z")
> While I’m no Next.js expert My question should be generic to any backend > encrypting the cookie is part of the [security model](https://github.com/auth0/nextjs-auth0#cookies-and-security). I don’t see any mention of encryption except for here which is only documenting the env variable: [GitHub - auth0/nextjs-auth0: Next.js SDK for signing in with Auth0](https://github.com/auth0/nextjs-auth0#configure-the-application) > When you say JWT, are you referring to the ID token or access token? Leaking of an access token especially is definitely a security concern. In general a [JWT token](https://jwt.io/) token should not contain an access token. This is what I mean when I said that leaking the token ~~is~~ should\* be of no concern. Secure authentication is provided by the JWT having been signed by Auth0 (whom we trust). The user’s ID inside the JWT token is trusted as the user’s genuine ID because we can validate auth0’s signature. That’s the security model of Auth0 as a service. And then any encryption between the user and the backend is provided by HTTP encryption (HTTPs). I do see that ours does contain an access token, and that it is used to query our own API server. We **DO** give this access token to the client in the clear so that the client can query our API server! This is fine and normal behaviour. The client is what is called a “public client”. It is the user’s key, so giving it to the user is okay. It’s like how you show us our keys on your dashboard. You wouldn’t call that a “leak”. Ref: [Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens#access-token-security) ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [December 23, 2023, 12:12am UTC](https://community.auth0.com/t/why-do-you-encrypt-the-cookie/119203/6 "2023-12-23T00:12:48Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.