4 ms·
Can anyone explain what this means (or point me to somewhere where I can learn?) > If a stateless architecture being used, use a MAC or an authenticated encryp
by stevoski 9y ago
Can anyone explain what this means (or point me to somewhere where I can learn?)
> If a stateless architecture being used, use a MAC or an authenticated encryption mode to authenticate input.
I ask as a developer of a SaaS product. I understood most of the tips but not this one.
- zzzcpan 9y agoPresumably, if you don't want to store some state on the server for a client, you can go stateless and store it only on the client but with MAC, so you can authenticate it. For example for session cookies.
- gkop 9y agoThey're implying that you are storing state in the client which sends that state back to your system in subsequent requests, e.g. an HTTP cookie. If doing so, make sure to use a MAC [0] to tell if the client has tampered with the state you stored. [0] https://en.wikipedia.org/wiki/Message_authentication_code https://en.wikipedia.org/wiki/Message_authentication_code