Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yeah, both this and the original article are vulnerable to replay attacks. A token is much better, but there are times when you don't want to hit the DB, such as for non-critical data like displaying the user's name on the page. Signing a cookie is reasonable then.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: