202 reputation
38
bio website bbc.co.uk/football
location Sao Paulo, Brazil
age 33
visits member for 2 years, 10 months
seen Apr 12 at 3:57

I'm a code and development enthusiast.

Cheers!


Jul
15
awarded  Popular Question
Jul
15
awarded  Yearling
Mar
25
awarded  Notable Question
Mar
5
awarded  Popular Question
Aug
22
awarded  Caucus
Aug
22
awarded  Constituent
Jun
8
comment Is my current method of handling session cookies insecure?
@Yoaov, I've actually figured that part out already. It's just making sure it's secure. See accepted answer. Cheers!
Jun
8
accepted Is my current method of handling session cookies insecure?
Jun
8
comment Is my current method of handling session cookies insecure?
Wow, thank you for that thoughtful write up. This is great information!
Jun
6
comment Is my current method of handling session cookies insecure?
@Woot4Moo, I can't say I know the answer to that myself. Presumably difficult enough to deter would be attackers. My login system is borrowed from an authoritative reference that has been implemented and tested a plethora of times; and I followed to devotedly, until the issue of subdomains cropped up.
Jun
6
comment Is my current method of handling session cookies insecure?
@JeffFerland, Yes. I have that covered. Rails has a handy controller method called protect_from_forgery which inserts a random token.
Jun
6
revised Is my current method of handling session cookies insecure?
edited title
Jun
6
revised Is my current method of handling session cookies insecure?
deleted 1 characters in body
Jun
6
revised Is my current method of handling session cookies insecure?
added 56 characters in body; edited title
Jun
6
asked Is my current method of handling session cookies insecure?
Dec
6
accepted Is it safe to store the password hash in a cookie and use it for “remember-me” login?
Dec
5
comment Is it safe to store the password hash in a cookie and use it for “remember-me” login?
I don't understand something, perhaps this is another question in itself. Why does it matter if the userId is know? There are many sites where you can view people's ids by navigating to their profile page: *.com/users/123 -- doesn't that depend on the security of the application itself? Why do we need to encrypt a userId/hash when the id is readily available by visiting someone's profile?
Dec
5
awarded  Editor
Dec
5
revised Is it safe to store the password hash in a cookie and use it for “remember-me” login?
added 4 characters in body
Dec
5
comment Is it safe to store the password hash in a cookie and use it for “remember-me” login?
Thanks for the info. I meant to say I use SHA-512, not MD5 for password encryption.