4 ms·

It seems this has all disadvantages of jwt-style sessions, plus a BREACH-style vulnerability in the crypto due to compression if `plain-text-cookie-value` conta

by kpcyrd 8y ago

It seems this has all disadvantages of jwt-style sessions, plus a BREACH-style vulnerability in the crypto due to compression if `plain-text-cookie-value` contains data an attacker can taint.

tptacek 8y ago
Yeah, I'm pretty confused by this being on the front page.
ryacko 8y ago
Worse: “SCS doesn't address replay of old cookie values.”