Re: Replay attacks with cookie session

Brad Ediger
2007-03-23T14:39:22Z

On Mar 23, 2007, at 3:30 AM, Sandofsky wrote:

>
> Pulling two IDs (session id + nonce) from the DB is better than
> pulling 80k that could go in cookies. Why not include nonce in the
> default, and if the developer wants the blazing speed (and
> corresponding dangers), they can disable it?

80k cannot go in cookies. On most platforms the limit is 4k. The
CookieStore raises an error if you try to store too much.

And it''s a difference between grabbing the data from the DB to
deserialize it and grabbing it from a cookie to deserialize it. The
main driver isn''t performance -- it''s not having to keep all
of those
sessions around on the web server.