Skip to main content

New answers tagged

1 vote

Deciding whether user has left the site without logging out or has simply left the site open for notifications without actually doing any work?

I think things have evolved quite a bit since the original answers. In general, my suggestion is to not log the user out unless absolutely necessary (policy), explicitly requested, or in a context ...
multithr3at3d's user avatar
2 votes
Accepted

CSRF Prevention Using Signed Cookies And Custom Headers

This is, in fact, mostly already the standard way to use double-submit cookies in script-driven apps. The main innovation is signing the anti-CSRF token, which actually doesn't add anything in most ...
CBHacking's user avatar
  • 49.5k
0 votes

CSRF Prevention Using Signed Cookies And Custom Headers

The approach is valid and provides solid security. Combining two different anti-CSRF mechanisms makes sense for defense-in-depth. Even though a custom header should be sufficient (as Steffen Ulrich ...
Ja1024's user avatar
  • 11.3k

Top 50 recent answers are included