Re: Replay attacks with cookie session

S. Robert James
2007-03-28T02:46:13Z

There are some other very serious security issues with cookie store as
it stands now.

As I said earlier, I''m waiting for a spec and sample app before
working on a full review.  If those never happen, I''ll eventually post
the sketches that I already have.  But I think the community would be
happier with a material "this is how the app can be compromised" over
"theoretically, depending on the implementation, this might be the
problem."  Anyway, if I don''t here back on those things,
I''ll post my
notes from conversation - if I do, I''ll try to get a full review done.

On Mar 27, 12:05 pm, "Alexey Verkhovsky"
<alexey.verkhov...@gmail.com>
wrote:
> +1 to:
>
> CookieStore should be either (1) secure against replay
>
> > attacks by default, or (2) not the default session store. Anything
> > else is asking too much of non-security-aware developers.