Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
How secure is the strategy used in which the cookie consists of base64 encoded array content followed by (I believe) a SHA1 hash of that content salted with a long session_secret known only to the server? The hash is, as I understand it, a signature to prevent the client from tampering with the cookie contents. Is this system secure? In particular, could an attacker figure out how to forge the signature without having access to the session_secret? Are there any other vulnerabilities?
SHA1 has known vulnerabilities, so if that’s what it uses, I wouldn’t recommend it. In theory, this can be exploited to forge the signature.