3 ms·

I know the cookie example was just an excuse to talk about cryptography but I found it strange that there was no mention of using a randomly generated session I

I know the cookie example was just an excuse to talk about cryptography but I found it strange that there was no mention of using a randomly generated session ID and a session store as most web frameworks do.

Kliment 12y ago
Plaintext SID? Couldn't you just replay that SID then? Or generate random SIDs and see what sticks?
- seszett 12y ago
  If your SIDs are large enough, it's no different from generating random encrypted cookies until one works, so not practical at all.
jameshart 12y ago
The SSO scenario deals precisely with how to pass authentication between two systems which do not have a shared backend datastore.
- callesgg 12y ago
  Well encrypting the data is not really needed. Singing the data is.