# Does a security issue with the node cookies continue to exist nowadays?

**URL:** <https://erlangforums.com/t/does-a-security-issue-with-the-node-cookies-continue-to-exist-nowadays/4035>\
**Category:** Questions / Help\
**Tags:** security\
**Created:** [September 29, 2024, 12:53pm UTC](https://erlangforums.com/t/does-a-security-issue-with-the-node-cookies-continue-to-exist-nowadays/4035 "2024-09-29T12:53:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![patricio3661](https://erlangforums.com/letter_avatar_proxy/v4/letter/p/c67d28/32.png) [@patricio3661](https://erlangforums.com/u/patricio3661)\
**Post date:** [September 29, 2024, 12:53pm UTC](https://erlangforums.com/t/does-a-security-issue-with-the-node-cookies-continue-to-exist-nowadays/4035/1 "2024-09-29T12:53:11Z")

</div>

Does this issue still exist? Given that the guys has mentioned that a fix would involve a lot code change.

[![](https://img.youtube.com/vi/42k70Y-yTYY/maxresdefault.jpg "#HITB2017AMS COMMSEC D2 - Unauthorized Erlang: A Demonstration - Don Bailey") ](https://www.youtube.com/watch?v=42k70Y-yTYY)

And is there a PoC for it?

---

<div class="post-metadata">

**Author:** ![starbelly](https://erlangforums.com/user_avatar/erlangforums.com/starbelly/32/209_2.png) [@starbelly](https://erlangforums.com/u/starbelly)\
**Post date:** [September 29, 2024, 6:13pm UTC](https://erlangforums.com/t/does-a-security-issue-with-the-node-cookies-continue-to-exist-nowadays/4035/2 "2024-09-29T18:13:42Z")

</div>

I didn’t watch the talk in full, skimmed through it, and it sounds like a few issues were discussed, but at the start it was mentioned that some patches were created per issues the speaker found. If I can find the time I can double back and watch the video in full or perhaps you can ask more specific questions? Maybe someone from OTP team who was involved with the patches at the time can comment further.

That said, you should follow the manual and :

1. Generate cookies using crypto
2. Do use TLS.
3. Try to treat cookies more as a means to wall off nodes from other nodes vs a security mechanism (but do heed point 1) and rely on TLS and other means more for security.

See [distributed erlang](https://www.erlang.org/doc/system/distributed.html)

---

<div class="post-metadata">

**Author:** ![jhogberg](https://erlangforums.com/user_avatar/erlangforums.com/jhogberg/32/179_2.png) [@jhogberg](https://erlangforums.com/u/jhogberg)\
**Post date:** [September 30, 2024, 7:05am UTC](https://erlangforums.com/t/does-a-security-issue-with-the-node-cookies-continue-to-exist-nowadays/4035/3 "2024-09-30T07:05:06Z")

</div>

The cookie is not a security measure, it’s meant to prevent distinct clusters from crossing each other on a local and secure network. The documentation states that it’s there to prevent accidental misuse, not a deliberate attack.

We never considered this a security issue in and of itself because no one in their right mind would run the _unencrypted and unauthenticated_ Erlang distribution unsecured over the internet.

There is nothing to fix other than for people who do that, to stop doing that.