A signed cookie is a browser cookie that includes a cryptographic signature, usually created with a server-side secret key. The signature lets the server verify that the cookie was not modified in transit. If the value changes, verification fails and the cookie should be rejected. A signed cookie protects integrity, but not confidentiality: users can still read its contents unless they are also encrypted.
Signed cookies matter because many web apps store session data or state in them. If the signing secret is exposed, reused, or implemented badly, an attacker may forge a valid cookie and impersonate a user or alter application state. In real attacks, signed cookies often appear in session forgery, privilege escalation, or abuse of frameworks such as Flask. Defenders should keep secrets isolated, rotate them carefully, minimize client-stored state, and never treat a valid signature as proof that the data is safe to trust for sensitive logic.