Re: Replay attacks with cookie session

Brad Ediger
2007-03-23T22:03:06Z

On Mar 23, 2007, at 4:47 PM, S. Robert James wrote:

> @Brad - Great work on setting up some code for benchmarking.  I
> haven''t reviewed your code,  but doing nonces correctly gets into
some
> sticky synchronization and concurrency.  Basically, the system needs
> to make sure that:
>
> * The nonces used by all of the Mongrels are kept track of (eg one
> counter per Mongrel)
>
> * No Mongrel uses the same nonce (eg prefix the nonce with the
> Mongrel''s pid)
>
> * That the issuing a nonce, restoring a session, and then invalidating
> the nonce are all done in the correct order.  This can get very
> tricky

Don''t use that code. I had the wrong approach about this, and just
saw my mistake. We will need to rethink the approach, probably after
review from an expert. I''ll be thinking about this in the meantime,
and I''ll try to at least think a little next time before I start
coding.