Re: Replay attacks with cookie session

Luca Mearelli
2007-03-23T08:28:18Z

Michael Koziarski wrote:
> That most applications *already* change their session store indicates
> that it''s not that big a deal.

My feeling (this is what I did) is that this happens because they *got
bitten* by the default session store problems, the effects are visible
(mainly the performance issues).

> If you''re currently doing something
> which is incompatible with the assumptions of the cookie store,
> switch.
this could be solved by clearly documenting this assumptions (and
perhaps giving suggestions)

> I''m still using sql sessions and intend to continue doing so
> :).
hmm... how about defaulting to these (at least for the production
environment)?

Luca
--

Web:   http://spazidigitali.com - http://thetyper.com
Email mailto://luca.mearelli@gmail.com
Skype callto://l.mearelli
--