OpenID: Why is storing claimed IDs in cookies safe?

Question

I just started integration of OpenID in my website. All the examples I saw store the claimed IDs in cookies. How is it safe?

For example, myopenid.com returns a claimed ID that is {username}.myopenid.com

So if a hacker knows your claimed ID, he can easily hack your account.

Of course you encipher/md5 the ID before putting it into the cookies and using for authentication, but it's like storing a username without password!

Update

Now that I thought more about it, I realized, that you need to be logged in the OpenID provider, so even if the hacker gets the username, he still needs the provider's password to log in. Am I correct?

Update 2 No, update 1 is not correct :) My site cannot check whether the user is successfully logged in or not. All I receive is the claimed ID, and I just have to trust that the user is authenticated. That's really confusing...

Answer 1

Knowing the user's claimed identity isn't enough to authenticate.

Indeed, the user would have to be logged in to his provider, in order to authenticate with your website using that identity.

As for "trusting that the user is authenticated" -- no, you don't trust. As a final part of OpenID authentication you're supposed to verify that the authentication message comes from the provider. There are various security measures in place to ensure that the message is authentic, unaltered, etc. If you do that, you're sure that your user is properly authenticated by the provider.

Now, since you don't want to do it every time your user makes a request, you store the session information in a cookie. However, you don't store only the claimed identifier (if you decide to store it at all), but a session id -- a pseudorandom number generated at the moment your user logs in. Since it's pseudorandom, no one can guess it, and therefore, knowledge of a claimed identifier itself doesn't mean anything.

If that answers your question, read about session management in your favorite language/framework, as it will tell you how to easily implement such mechanism, and how it works.

In summary: think of OpenID as a replacement for a password verification. You don't need to (and shouldn't) store logins and passwords in cookies, and you don't have to store claimed identifiers. Similarly, you don't verify that the login and password matches every time, but remember that the user is authenticated in a session.