| From: | Rodrigo Gonzalez <rjgonzale(at)gmail(dot)com> |
|---|---|
| To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Tomasz Ostrowski <tometzky(at)batory(dot)org(dot)pl>, Lexington Luthor <Lexington(dot)Luthor(at)gmail(dot)com>, pgsql-general(at)postgresql(dot)org |
| Subject: | Re: Generating unique session ids |
| Date: | 2006-07-27 14:11:23 |
| Message-ID: | 44C8C98B.7090709@gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-general |
I'm not an expert as you, but what about a small table where just one
user can read and create the function with this same user and definer
security?
Excuse if I say something stupid
Alvaro Herrera wrote:
> Tom Lane wrote:
>
>
>>> * Any database user is most of the time able to read function
>>> bodies, so anybody who is able co connect to your database will be
>>> able to get your 'secret_salt' and then predict session id's.
>>>
>> Yeah, it's not clear where to hide the secret.
>>
>
> In a memfrob'ed (or something better probably) area in a C function?
>
>
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Scott Eade | 2006-07-27 14:34:15 | UTF-8, upper() and Chinese characters yielding blank result |
| Previous Message | Markus Schiltknecht | 2006-07-27 14:07:13 | Re: Database Oid from SPI |