3 ms·
Can't you accept the previous session id from the client so it would allow an authentication attempt?
by GoblinSlayer 4y ago
Can't you accept the previous session id from the client so it would allow an authentication attempt?
- quesera 4y agoI do give some preference to requests that come in with a well-formed session ID. I can't check whether it's real prior to granting the preference (the round trip is too expensive to justify in a high-load scenario, but I can check the signature validity at least. But of course lots of legit authentication attempts come from new users, or new sessions. So I need to allow that case as well, and then we're back at square one.