Re: Replay attacks with cookie session

Brad Ediger
2007-03-22T05:23:44Z

On Mar 22, 2007, at 12:16 AM, Alexey Verkhovsky wrote:

> On 3/21/07, Brad Ediger <brad@bradediger.com> wrote:
> You and I think alike. I was just considering this the other day as
> well. The trivial fix is to say "don''t store sensitive
transient data
> in the session".
>
> Heh... how about a user ID? What if an evil hacker sets it to 1,
> assuming that the first user is likely to be admin?
>

He can''t, the HMAC wouldn''t verify.