search

actix / actix-extras

A collection of additional crates supporting the actix and actix-web frameworks.
https://actix.rs
Apache License 2.0
760 stars 191 forks source link

How does actix-session protect from replay attacks? #416

Closed dzervas closed 5 months ago

dzervas commented 5 months ago

As the title says, how does actix-session behave if an older cookie is sent (e.g. the cookie before making an insert or delete)? Does it have a unique number that should match the DB and changes on every save?

dzervas commented 5 months ago

After testing a new cookie is set on each request that alters (or renews) the session and if reused it returns an error No session state has been found for a valid session key, creating a new empty session.. Yay! :tada: