Re: Replay attacks with cookie session

S. Robert James
2007-03-23T22:00:34Z

On Mar 22, 11:42 pm, "Michael Koziarski" <mich...@koziarski.com>
wrote:
> If you''d like to coordinate this, I''d definitely be glad
to hear from
> them.  As it stands I think your complaint boils down to the lack of
> server-side invalidation of a session.  Most everything else flows
> from that.  I''m not sure that there''s a shared nothing
way to take
> care of that, but the crypto experts would know for sure.
>
> Please do investigate having someone conduct a review.

To get started, here''s a good link on the concept of replay attacks
and nonces:
http://www.openidenabled.com/openid/replay-attack-prevention

And here''s a nonce implementation by Sam Ruby (not a crypto expert by
any means, but a smart Ruby dev for sure - the implementation is in