Currently, impersonating another user's ID (identity is another matter) is easy because anyone can exploit the reconnection feature with anyone else's ID. Instead, clients should be given a secret upon connecting that they can use to reconnect again in the future.
This key should probably be permanently tied to a single identity as well (unless it has expired?)
Currently, impersonating another user's ID (identity is another matter) is easy because anyone can exploit the reconnection feature with anyone else's ID. Instead, clients should be given a secret upon connecting that they can use to reconnect again in the future.
This key should probably be permanently tied to a single identity as well (unless it has expired?)