Timeline for Cancelling a request stops new authentication cookie getting to browser, invalidating all further requests
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 25, 2019 at 11:16 | history | edited | Anders | CC BY-SA 4.0 |
added 44 characters in body
|
| Jun 25, 2019 at 11:13 | comment | added | Anders | @Zotoaster I see your point, but I don't think it is a very efficient way of protecting yourself against session hijacking, and it will cause you a lot of problems. So I would not do it. | |
| Jun 25, 2019 at 11:12 | vote | accept | Zotoaster | ||
| Jun 25, 2019 at 11:11 | comment | added | Zotoaster | The reason I did it is incase anyone managed to steal your cookie it would only be valid until you made your next request. But since I'm sanitising all the user inputs I don't think anyone can get your cookie (I might be wrong?). I just did it as an extra protective measure but it's not worth it with the problems it creates. | |
| Jun 25, 2019 at 11:04 | comment | added | Anders | @Zotoaster Check. You can solve a lot of this, but is there any real need to change the token? | |
| Jun 25, 2019 at 11:02 | history | edited | Anders | CC BY-SA 4.0 |
deleted 1 character in body
|
| Jun 25, 2019 at 11:01 | comment | added | Zotoaster | Regarding the multiple pages thing, there is a table of auth tokens with the user, so they can be signed in from multiple locations. The reason I make a new cookie is because I think I read that somewhere. How often should I refresh it? It can't be safe to keep it around forever. | |
| Jun 25, 2019 at 10:58 | history | answered | Anders | CC BY-SA 4.0 |