3 ms·
It's a MongoDB objectid. It's guessable. Still not seeing the problem yet, as you haven't bothered to explain it.
by heretohelp 14y ago
It's a MongoDB objectid. It's guessable. Still not seeing the problem yet, as you haven't bothered to explain it.
- gnaritas 14y agoSo what stops me from changing the user ID cookie to another user and impersonating them?
- daeken 14y agoThe HMAC authenticating the cookie.
- gnaritas 14y agoSo it is a secure cookie, that wasn't clear.
- heretohelp 14y agoSo going back to my original question, does this mean I have nothing to worry about?
- gnaritas 14y agoI won't dare give security advice with all the security professionals lurking around here.
- heretohelp 14y agoK, falling back to my "not giving a fuck" mode I was in before and assuming any compromises of the session would involve access to my backend servers which is worse than losing control of the sessions.