3 ms·
The session (or any auth) cookie is essentially the same as sending your password. Security wise there's no big difference between sending a password or a sessi
by chopin 6y ago
The session (or any auth) cookie is essentially the same as sending your password. Security wise there's no big difference between sending a password or a session cookie over https (other than the session cookie is short lived, which may have its merits).
- notriddle 6y agoUsing a session cookie about as important as using a salted hash for the database side; it's a mitigation for password reuse.