3 ms·
So what stops me from changing the user ID cookie to another user and impersonating them?
by gnaritas 14y ago
So what stops me from changing the user ID cookie to another user and impersonating them?
- daeken 14y agoThe HMAC authenticating the cookie.
- gnaritas 14y agoSo it is a secure cookie, that wasn't clear.
- heretohelp 14y agoSo going back to my original question, does this mean I have nothing to worry about?
- gnaritas 14y agoI won't dare give security advice with all the security professionals lurking around here.
- heretohelp 14y agoK, falling back to my "not giving a fuck" mode I was in before and assuming any compromises of the session would involve access to my backend servers which is worse than losing control of the sessions.