Well, technically you don't need to invalidate the earlier CSRF tokens. Saving a... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

tomp on Aug 6, 2013 | parent | context | favorite | on: Security advisory: Breach and Django

Well, technically you don't need to invalidate the earlier CSRF tokens. Saving a big number of CSRF tokens per user would of course require quite a lot of storage, but maybe you could devise some "clever" scheme, e.g. token = "n" + sha(user_secret + "n"), which would be random enough for preventing BREACH, but easy enough to check.

nwh on Aug 7, 2013 [–]

You'd want to have the secret last in the hash, otherwise you're open to hash extension attacks in some rare cases.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact