This repository has been archived by the owner on Feb 8, 2018. It is now read-only.

sign our session cookies #1500

Closed

chadwhitacre opened this issue Sep 24, 2013 · 1 comment

Labels

Contributor

chadwhitacre commented Sep 24, 2013

We should protect our sessions against MITM and DNS poisoning by signing our session cookies. References:

http://www.cse.msu.edu/~alexliu/publications/Cookie/cookie.pdf
http://security.stackexchange.com/questions/7398/secure-session-cookies
AspenWeb/pando.py#139

chadwhitacre mentioned this issue

Merged

ghost assigned chadwhitacre

Contributor

Changaco commented Aug 14, 2014

The session cookie itself doesn't need to be signed. Signing other cookies is discussed in #715.

Changaco closed this as completed

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.