Re: Replay attacks with cookie session

Brad Ediger
2007-03-25T12:41:58Z

On Mar 25, 2007, at 1:01 AM, Thijs van der Vossen wrote:

>
> On Mar 23, 2007, at 1:51, Brad Ediger wrote:
>> I might be over-concerned here, but I''m not talking about the
average
>> Rails developer. I''m talking about the worst ones. I can tell
you
>> that while the average Rails developer I''ve worked with would
>> certainly be able to understand this and work around it, I''m
not sure
>> that the worst ones would even understand what the issue was if it
>> were explained to them.
>
> So you actually want to start designing the framework for its _worst_
> users? :)

 From a security standpoint, absolutely. Certainly there is some
responsibility on the developer''s part to learn how the web works,
but the framework should be as forgiving as possible to new users.

--be