Re: Replay attacks with cookie session

Alexey Verkhovsky
2007-03-22T05:16:11Z

On 3/21/07, Brad Ediger <brad@bradediger.com>
wrote:
>
> You and I think alike. I was just considering this the other day as
> well. The trivial fix is to say "don''t store sensitive
transient data
> in the session".


Heh... how about a user ID? What if an evil hacker sets it to 1, assuming
that the first user is likely to be admin?

Alex