Re: Question about security tokens

2011/1/28 Alexandros Vellis <[email protected]>:
> I am implementing the security tokens in the avelsieve and
> useracl plugins.
>
> The page that shows the filters in avelsieve has a bunch of links that
> perform actions through HTTP GET, as well as some actions that are
> applied through POST (such as delete rule).
>
> The GET actions (move up,  move down etc.) can generate a lot of tokens
> for a single page; with a table of 50 filtering rules, I can generate
> as much as 100 - 150 tokens in a single page.
>
> In your opinion should I use a single token for these actions?

Yes, there's not much reason to use so many, all of which can be used
for each other's actions anyway.

> There is
> still the possibility of someone clicking something in a new tab and
> thus deactivating the rest of the options.

I don't know what that means.  Any one token, as long as it is valid,
can be used multiple times until it expires.

> Is there a drawback in creating too many tokens at all?

More processor cycles and that the tokens begin to bloat the user session data.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires 
February 28th, so secure your free ArcSight Logger TODAY! 
http://p.sf.net/sfu/arcsight-sfd2d
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel