7 lines
349 B
Plaintext
7 lines
349 B
Plaintext
To prevent session hijacking each sensitive form should include a one-time-use security token. Once the form is submitted, the token is invalidated and another token is generated for the next form. This prevents attackers who have intercepted or guessed a valid session id from exploiting it.
|
|
|
|
|
|
This rule raises an issue when a form is generated.
|
|
|
|
|