Clients can be spoofed - Githubissues

jtojnar / pengu

MIT License

2 stars 1 forks source link

Clients can be spoofed #3

Closed jtojnar closed 9 years ago

jtojnar commented 11 years ago

Currently the only identifier of message sender is name contained in message. This can be exploited when some client sends message with another user's name. This can be fixed by generating secret tokens for users and using them as communication authenticity verification keys.

Relevant issue: #2

jtojnar commented 9 years ago

Apparently this problem never existed. I must have been confused somehow as the clients never sent their name with the message.