Re: Replay attacks with cookie session

Neil Wilson
2007-03-27T15:36:07Z

On Mar 26, 7:40 pm, Brad Ediger <b...@bradediger.com>
wrote:
> How, exactly, would you model the login session so as to be immune to
> replay attacks with shared-nothing on the server side?

Use a server side session store, not a client side one.


> I do have a bigger problem with your statement that "If you
haven''t
> modelled the functionality, then you can''t expect to use it."
It is
> the job of the framework to give developers functionality that they
> don''t have to model. Otherwise Rails would just punt and say
"Here''s
> how you set and read a cookie. If you want to use sessions, model
> them yourself."

Why not go the whole hog and provide us with a default fifteen level
login system with access control lists?

The issue is where the framework ends and the application begins. A
Rails app that just uses the flash and a setting to determine whether
to show the welcome page doesn''t need nonces and anti-replay devices.

Perhaps the first job is to step back a little and ask how much you
*really* should stuff into session. What is the job of that little
semi-persistent-hash?

NeilW