Re: Replay attacks with cookie session

Thijs van der Vossen
2007-03-22T08:44:41Z

On Mar 21, 2007, at 19:43, S. Robert James wrote:
> I''m concerned about the possibility of replay attacks with cookie
> sessions.  This is a standard security issue.
>
> Example:
> 1. User receives credits, stored in his session
> 2. User buys something
> 3. User gets his new, lower credits stored in his session

Your example scenario is unrealistic. If you really think it''s a good
idea to store such important stuff as your user''s credit in a session
instead of in your database you probably have bigger issues to worry
about. :)

As long as you only use the session to maintain the id of the
authenticated user and for flash messages there''s absolutely nothing
to worry about.

Kind regards,
Thijs

P.S. If you really _do_ think it''s a good idea to store your
user''s
credit in the session, please google for ''share-nothing'' and
''database transactions'' and do some reading.

--
Fingertips - http://www.fngtps.com

Phone: +31 (0)6 24204845
Skype: tvandervossen

MSN Messenger: thijs@fngtps.com
iChat/AOL:  t.vandervossen@mac.com
Jabber IM: thijs@jabber.org