Re: Replay attacks with cookie session

S. Robert James
2007-03-22T20:51:21Z

On Mar 22, 3:08 pm, Courtenay <court3...@gmail.com>
wrote:
> You''re forgetting that:
>     (a) sessions already use cookies to store the session ID, so any
> issues with cookie interception or other attacks apply to all session
> storage methods.

Not true.  Example: if, on logout, you update the session in the DB to
state "No User", the cookie is worthless.

>     (b) you can''t change the contents of the cookie or it will
fail the HMAC.

Yes, but you can replay them.  See my first post.

> If you''re overly concerned with "user_id" haxoring, just
use a guid
> instead of DB id in your User.find

Won''t help - see earlier posts.