Re: Replay attacks with cookie session

Pete Yandell
2007-03-28T04:42:07Z

On 23/03/2007, at 6:19 AM, Brad Ediger wrote:

> (a) Cookie sessions are vulnerable to replay attacks, because the
> client can present *any* cookie that it has seen to the server, not
> just the most recently sent one. On the other hand, server-side
> storage methods are not vulnerable because the session ID always
> references the latest version of the session.

+1 for hitting the nail on the head.