RE: Custom session tokens and XSS

I think I may be misunderstanding this, but if the attacker makes a web request and gets a valid token, it will be a valid token for HIS session. By creating a malicious email/web page with this token, the victim will be opening the attackers session!
Any XSS in the page, will only have access to the attackers token - which is useless from an attack point of view.

Stephen de Vries

On Tue, 12 Aug 2003, Rob Morhaime wrote:

> I do believe this setup would be vulnerable to a "session fixation" attack, as
Received on Wed Aug 13 07:14:46 2003