Re: Replay attacks with cookie session

Michael Koziarski
2007-03-23T00:46:00Z

> Avoiding a single database lookup isn''t the purpose of the cookie
store.

It''s worth remembering the downsides to our current default.
Deploying to a ''real'' production setup with it is a shortcut
to a
heart attack.  File locking, mongrel deadlocking, NFS churn.   All of
those are real problems which hurt developers every day.

That most applications *already* change their session store indicates
that it''s not that big a deal.  If you''re currently doing
something
which is incompatible with the assumptions of the cookie store,
switch.  I''m still using sql sessions and intend to continue doing so
:).


--
Cheers

Koz