RSS Feed/News Encode login status in session cookie

Status
Not open for further replies.

ENXF NET

Administrator
Staff member
Administrator
Moderator
+Lifetime VIP+
S.V.I.P.S Member
S.V.I.P Member
V.I.P Member
Collaborate
Registered
Joined
Nov 13, 2018
Messages
27,308
Points
823

Reputation:

Right now it is not possible to distinguish a logged in user from a guest by just looking at the session cookie - if both cases it's just a random string.

Being able to distinguish a guest from a logged in user on the webserver level (or a reverse proxy in front of that) could be quite useful for applying different rules (like rate limits, challenges, etc.) partly based on the login status.

I therefore suggest to add a flag to the session cookie value (for example a prefix...

Read more

Continue reading...
 
Status
Not open for further replies.
Top