innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Fixed a sentence in the session security docs; thanks claudep.

This commit is contained in:
Tim Graham 2014-01-03 12:02:58 -05:00
parent e6800ea136
commit 4d27d311f6
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/topics/http/sessions.txt
View File

@ -655,8 +655,8 @@ Session security
================ ================
Subdomains within a site are able to set cookies on the client for the whole Subdomains within a site are able to set cookies on the client for the whole
domain. This makes session fixation possible if all subdomains are not domain. This makes session fixation possible if cookies are permitted from
controlled by trusted users (or, are at least unable to set cookies). subdomains not controlled by trusted users.
For example, an attacker could log into ``good.example.com`` and get a valid For example, an attacker could log into ``good.example.com`` and get a valid
session for their account. If the attacker has control over ``bad.example.com``, session for their account. If the attacker has control over ``bad.example.com``,