Re: Replay attacks with cookie session

Daniel N
2007-03-23T00:43:35Z

On 3/23/07, Courtenay <court3nay@gmail.com> wrote:
>
>
>
>     (b) you can''t change the contents of the cookie or it will
fail the
> HMAC.
>
> If you''re overly concerned with "user_id" haxoring, just
use a guid
> instead of DB id in your User.find
>
> court3nay


So does this mean that I can''t use the cookie for client side
javascript?
If I want to use it to keep track of some client side script, then I
can''t?   Is that true?

Cheers