https://wiki.mozilla.org/index.php?action=history&feed=atom&title=Identity%2FSecurity%2FReplay_attacks 2026-09-21T06:46:56Z Revision history for this page on the wiki MediaWiki 1.39.10 https://wiki.mozilla.org/index.php?title=Identity/Security/Replay_attacks&diff=651367&oldid=prev 2013-05-02T05:56:58Z

<p>Created page with &quot;= Assertion replay = == Risks == * If an assertion is captured by an attacker, it can be replayed to an RP to gain entry to that site and impersonate a user there. == Mitig...&quot;</p> <p><b>New page</b></p><div>= Assertion replay =<br /> <br /> == Risks ==<br /> <br /> * If an assertion is captured by an attacker, it can be replayed to an RP to gain entry to that site and impersonate a user there.<br /> <br /> == Mitigations ==<br /> <br /> * assertions are only valid for 2 minutes<br /> * we recommend that sites send the assertion to their backend over HTTPS<br /> * verifiers could keep track of assertions they have seen in the last 2-3 minutes (&lt;tt&gt;verifier.login.persona.org&lt;/tt&gt; doesn&#039;t do that)<br /> <br /> == Notes ==<br /> <br /> Typically, on HTTP-only sites, attackers can already steal session cookies. The ability to create a new session after stealing an assertion is more useful since it allows the attacker to keep going after the real user logs out of the site with his/her session.</div>

Fmarier