New answers tagged nonce
This is a broken design because a GUID is not supposed to be secret, yet from what I understand it provides access identical to entering your username and password on the website. In theory the design is solid. Protect the GUID as if it were the user's password and case closed. In practice this introduces a lot of problems. Example: I start working at ...
To your second question - use a self incrementing nonce starting from 0 (for example), should a nonce ideally not be hard to guess? A linearly incrementing nonce is, by nature, predictable.
A nonce is a "number used once". This is question is asking "should I use a the same value for my nonce each time". The answer is no. Start with a number which is not predictable, e.g. from a good random source.
When you open a new tab and access linkedin the copkie which contains the session is automatically transmitted to linkedin. Linkedin checks the session and if it is valid you are logged in. A CSRF is usually only required for modifying requests, e.g. if you update some of your account settings or something like that. When the page with the form is ...
Top 50 recent answers are included