4 ms·

This doesn't seem to protect from Pass the Cookie attacks. Edit - it's a common red teaming tactic: https://wunderwuzzi23.github.io/blog/passthecookie.html htt

by kerng 8y ago

This doesn't seem to protect from Pass the Cookie attacks. Edit - it's a common red teaming tactic: https://wunderwuzzi23.github.io/blog/passthecookie.html https://wunderwuzzi23.github.io/blog/passthecookie.html

0xfffff 8y ago
Correct, it doesn't. If you grab that cookie and then pass the cookie from somewhere else it will work. Section 7.2.3 talks about cookie theft.
- kerng 8y ago
  Yeah, as others have pointed out this RFC is from 2013 - so a bit dated.