Re: Replay attacks with cookie session

Patrick Ritchie
2007-03-22T18:58:40Z

Courtenay wrote:
> On 3/22/07, S. Robert James <srobertjames@gmail.com> wrote:
>
>> On Mar 22, 10:44 am, Brad Ediger <b...@bradediger.com> wrote:
>> Now, I click "Log Out", and get up from the
library''s computer, only
>> to let the person waiting after me to retrieve the old cookie.... That
>> innocuous user id just became both sensitive and transient.
>>
>
> You click ''log out'' and it deletes the cookie.
> This is no different to a normal server-based session.
>
Actually, if you have the cookie set to expire at the end of the
session, simply closing your web browser should delete the cookie.

Cheers!
Patrick