Re: Replay attacks with cookie session

Alexey Verkhovsky
2007-03-22T13:52:47Z

On 3/22/07, Thijs van der Vossen <t.vandervossen@gmail.com>
wrote:
>
> As long as you only use the session to maintain the id of the
> authenticated user and for flash messages there''s absolutely
nothing
> to worry about.
>

Sure, but...

Not everybody who develops web apps knows about "do not keep anything
interesting in sessions" mantra, or agrees with it. At least a couple of
times I had to explain it to people who were not clueless by any standard.

It''s actually a rather arcane bit of knowledge, and if you
don''t have it,
you may discover it the hard way, when it''s too late.

Which makes session storage in cookies a good option, but perhaps not a good
default (?)

Alex