9
votes
3answers
878 views

Length of CSRF Token

Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
8
votes
7answers
330 views

Aren't permanantly logged in accounts inherently insecure?

The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...