Where should cart IDs be stored?

Retired Boards Appdev Custom Storefronts
1

Is it OK to store a cart ID in a cookie, it says in the docs it should be private but the mock.shop storefront uses a cookie.

2

Hi Sz55,

Mock.shop is a demo storefront just meant for testing purposes, so I would default to the docs and store cart privately.

3

Although the cart ID alone can not be used maliciously, it can when combined with other information. It is advised not to store cart IDs in a cookie for the following reasons.

  1. Storing sensitive information in cookies can expose it to security risks. It could potentially be used maliciously if intercepted or manipulated.
  2. Users can delete cookies, either manually or through browser settings that clear cookies on exit. This could lead to loss of the cart session data, requiring users to re-add items to their cart.

However, if you are using a javascript framework with server components, you can set HttpOnly cookies from the server side components. This setup can enhance security by preventing javascript code from accessing sensitive information in the browser.

If you decide to store cart IDs in cookies, make sure to use HttpOnly and be aware of the potential risks.

Hope this helps