3 ms·
This isn't totally correct. The problem isn't the cookie itself, but rather the cookie's integrity isn't cryptographically verifiable. One could use a cryptog
by tragictrash 5y ago
This isn't totally correct.
The problem isn't the cookie itself, but rather the cookie's integrity isn't cryptographically verifiable.
One could use a cryptographic signature set in the cookie to avoid tampering, using a HMAC or some other hashing function.
We don't need or want to hide the Id and rate key from the user, we just need to verify the integrity of it.
- kevincox 5y agoYes, correct. However depending on the proxy/tool doing the rate limiting it may be easier to limit based on a key in a separate cookie or header than extracting from a signed cookie. Even if the other cookie or header is logically covered by that signature keeping it more separate may make it easier overall.