2 ms·
There are tricks there too. If you just lookup in the database, I could find out how much time it took to retrieve the strings, this will leak the session id ov
by DenisM 10y ago
There are tricks there too. If you just lookup in the database, I could find out how much time it took to retrieve the strings, this will leak the session id over time. Databases don't do constant-time data retrieval. You would have to come up with a way to retrieve the session token from the database at constant time, or at least time that does not betray the session id.
- marcus_holmes 10y agoBut the session id isn't sensitive, is it? I mean most session verification middleware checks the ip address of the request against the address of the session login. If the address's don't match you kill the session and force another login. I usually just put the session id in a cookie and use https to encrypt the whole stream shrug