Re: Replay attacks with cookie session

Brad Ediger
2007-03-23T01:02:34Z

On Mar 22, 2007, at 7:43 PM, Daniel N wrote:

>
>
> On 3/23/07, Courtenay <court3nay@gmail.com> wrote:
>
>
>     (b) you can''t change the contents of the cookie or it will
fail
> the HMAC.
>
> If you''re overly concerned with "user_id" haxoring, just
use a guid
> instead of DB id in your User.find
>
> court3nay
>
> So does this mean that I can''t use the cookie for client side
> javascript?  If I want to use it to keep track of some client side
> script, then I can''t?   Is that true?
>

Nope. Cookies are referenced by name. As long as you don''t try to use
the same name for your session cookie and your client-side JS, you
will be fine.

be