5 ms·
To answer your question about monkeying: Sign the cookie! We sign session cookies with HMAC, and reset the session if it doesn't match. Doesn't handle replay at
by jdmichal 10y ago
To answer your question about monkeying: Sign the cookie! We sign session cookies with HMAC, and reset the session if it doesn't match. Doesn't handle replay attacks, but you at least know that you're getting back the same data that you gave the client.
- richthegeek 10y agoDoes signing the cookie with secondary information such IP or UA help? I know they can both be spoofed, but it's an extra layer...
- PeterisP 10y agoSigning the cookie with IP would break the site for everyone with changing IPs, e.g. mobile users on cellular networks. Web site sessions should persist across IPs.
- jessaustin 10y agoDoesn't handle replay attacks... This is why we have CSRF tokens, right? Orthogonal to session cookies, but when used together they avoid this vuln.