Re: Replay attacks with cookie session

Brad Ediger
2007-03-23T01:05:06Z

On Mar 22, 2007, at 7:46 PM, Michael Koziarski wrote:

>
>> Avoiding a single database lookup isn''t the purpose of the
cookie
>> store.
>
> It''s worth remembering the downsides to our current default.
> Deploying to a ''real'' production setup with it is a
shortcut to a
> heart attack.  File locking, mongrel deadlocking, NFS churn.   All of
> those are real problems which hurt developers every day.
>
> That most applications *already* change their session store indicates
> that it''s not that big a deal.  If you''re currently doing
something
> which is incompatible with the assumptions of the cookie store,
> switch.  I''m still using sql sessions and intend to continue doing
so
> :).

This is a good point. The CookieStore is a major improvement over
PStore from a functional perspective. We are arguing over things that
are important to discuss, but still very, very small compared to that.