4 ms·
You as the attacker can visit the page and get yourself a session cookie that is valid and set that on the victim's computer...
by X-Istence 14y ago
You as the attacker can visit the page and get yourself a session cookie that is valid and set that on the victim's computer...
- samarudge 14y agoWould it increase security to include the user-agent, or part of the user-agent, in the HMAC secret? So the secret was "abc123Mozilla[etc]", that would then presumably require identical browsers to work, at the expense of logging everyone out every time their browser updates. Or include all, or part of the IP address to restrict the network.
- 0x0 14y agoJS can get at that with "navigator.appVersion"
- X-Istence 14y agoUsing the IP address to restrict it would work, since now the attacker would need to have the same IP address to get a session that will stick, but this may cause users to be logged out when their ISP changes their IP, or when they move from home to a coffee shop for instance.