On Fri, Sep 30, 2011 at 1:45 PM, Dmitry Chestnykh <[email protected]>wrote:
> 1. Store some random bytes in database per user. This string will be a > secret_key for HMAC. > ... 4. To logout all sessions, go to step 1 (replace secret_key in database with > a new randomly generated one, thus invalidating all cookies). > That's a very interesting idea. i hadn't thought about a per-user secret. We (==in Germany) have a 3-day weekend, and this is one of the problems i hope to tackle during that time. > Note: it's better to use double-HMAC as implemented in my authcookie > package for Go language: https://github.com/dchest/authcookie [according > to this paper: > http://www.cse.msu.edu/~alexliu/publications/Cookie/cookie.pdf] > i know almost nothing about security-related issues - 90% of what i know about cookie security i learned from grokking fossil's login cookie (i had to for the JSON login implementation). That means: i'll use whatever code i can get to do this, as long as i don't actually have to come up with a custom security mechanism or write the hashing implementation :). -- ----- stephan beal http://wanderinghorse.net/home/stephan/
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
