3 ms·
If an attacker uses a compromised session id before it is regenerated, the attacker will receive the regenerated session too. They'll have a long-lived session
by mmcnickle 13y ago
If an attacker uses a compromised session id before it is regenerated, the attacker will receive the regenerated session too. They'll have a long-lived session to the victims account.
- kijin 13y agoIf the attacker uses a compromised remember-me cookie, it will also be regenerated for him. Same problem.
- mmcnickle 13y agoIf you use the scheme described linked from the article, when the legitimate user logs in again, the attacker will lose access to the session permanently.
- kijin 13y agoOh, I see. A separate cookie makes it easier for you to check for compromised sessions. I suppose you could also do that with regular session cookies if you keep good track of identifier history, but it'd be a lot more hassle.