title: Safety of cookies in codeigniter (and in general)
body: <p>I do not fully understand the vulnerability of cookies, except that through reading it seems they can be changed...</p>
  
  <p>Regardless, it seems like somewhat common practice to store user 'roles' or 'permissions' in a cookie. </p>
  
  <p>Is it an incorrect assumption that this is the norm?</p>
  
  <p>How else would one go about trying to secure a user role? 
  Would I have to query the DB every time I wanted to get the user's role?</p>
  
  <p>I am working with codeigniter right now and do stuff like </p>
  
  <pre><code>$this-&gt;session-&gt;set_userdata('role') = 'admin';
  </code></pre>
  
  <p>then access it like</p>
  
  <pre><code>if ($this-&gt;userdata('role') == 'admin'){
      allow access to important web aspects... and special database inserts
  }
  </code></pre>
  
  <p>Sincere thanks for any help or further understanding.</p>