Is there any way you might suggest decrypting this cookie? It was saved under the name mail, so I suspect it encrypts an email address:
Edit: Here is another one using another account:
When using a web portal, I noticed the same cookie is generated for my username every single time (i.e., it does not appear to be random). My concern is that there are several API endpoints with private info that can be accessed anonymously just using said string in the URL. I suspect the string is a kind of user identifier, but I am not sure if it is generated using the values from my email address, or randomly based on time of creation.
I can't go into specifics as I don't want this flaw to be exposed, compromising my info and getting me into trouble. However I know the portal is hosted on Microsoft IIS Server and built using the ASP.NET framework. I also suspect the implementation is rudimentary, so they probably aren't doing anything more sophisticated.