I have read this article http://jaspan.com/improved_persistent_login_cookie_best_practice
i intend to implement cookie theft detection mechanism Barry Jaspan devised in it.
but a problem seemed to me.
i sent a letter about it to Jaspan several days ago, but he hasn't replied yet.
the problem is:
a user may open several (at least 2) tabs quickly in his browser.
the browser sends 2 requests with the cookie 'login_tok-dynamic_tok' to the application (our login system). login_tok is the token that will not change for the entire life time of the persistent login. dynamic_tok is the token that changes with every request.
first request that is executed by the server causes dynamic_tok to change in the database.
now the second request is processed and since the old dynamic_tok doesn't match the one in the database, a false positive will be generated.