4 ms·
> used a secret token for auth instead of a signed Seems that you'd still have an issue here, as the secret token would still be linked to a user ID somewhere
by bpicolo 9y ago
> used a secret token for auth instead of a signed
Seems that you'd still have an issue here, as the secret token would still be linked to a user ID somewhere in the system.
- jtmarmon 9y agoIf you use a secret token you would compare the token from the first user 123 to what’s stored in the DB (for the second user ID) see that it doesn’t match and not log them in. Because they used a signed user ID, there was no way to differentiate the user 123 from before the system restore and after.