News for hackers. Stuff that matters.

A comment on Backbone.js and Django. Parent comment

Re:Backbone.js and Django by theroo on Tuesday July 05, 2011 @07:45PM (#2732030)
Also, setting the cookie 'todos' to todolist.id will allow anyone to manipulate the value of that cookie in order to read anyone's cookies.
[ Parent | on HN ]
Re:Backbone.js and Django by po on Wednesday July 06, 2011 @12:51AM (#2732612)
With Django 1.4 (or the dev version) it will be possible to cryptographically sign a cookie:

https://docs.djangoproject.com/en/dev/topics/signing/

You can use this to store the session data with the user without having to consult a database and without fear that they will tamper with the id:

https://github.com/ericflo/django-cookie-sessions

[ Parent | on HN ]