New answers tagged session-fixation
SHA(auth-session-cookie) is only useful if the underlying value of auth-session-cookie is itself sufficiently large and random. Also auth-session-cookie should be short lived (eg. 2 minutes), so state isn't valid indefinitely to reduce the risk of replay attacks.
Top 50 recent answers are included