Timeline for Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 30, 2012 at 10:30 | comment | added | RPW | Thanks for the reply. I was looking at the likelihood of the cookie's being stolen on the one hand (remember, it is all SSL, secure, httponly, etc) vs. the relative unimportance of what is being protected on the other hand. And if you'll allow me a third hand, the relative effort in coding (remember, this is a hobby, not a day job or even a paying job). | |
| Sep 30, 2012 at 1:48 | comment | added | user10211 | +1, NEVER do this. Session hijacking is a very real threat. | |
| Sep 29, 2012 at 23:21 | history | answered | Lucas Kauffman | CC BY-SA 3.0 |