Hacker News new | ask | show | jobs
by mmcnickle 4742 days ago
If an attacker uses a compromised session id before it is regenerated, the attacker will receive the regenerated session too. They'll have a long-lived session to the victims account.
1 comments

If the attacker uses a compromised remember-me cookie, it will also be regenerated for him. Same problem.
If you use the scheme described linked from the article, when the legitimate user logs in again, the attacker will lose access to the session permanently.
Oh, I see. A separate cookie makes it easier for you to check for compromised sessions. I suppose you could also do that with regular session cookies if you keep good track of identifier history, but it'd be a lot more hassle.