diff options
Diffstat (limited to 'docs/topics/http')
| -rw-r--r-- | docs/topics/http/sessions.txt | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/docs/topics/http/sessions.txt b/docs/topics/http/sessions.txt index b336bf4669..c514978f57 100644 --- a/docs/topics/http/sessions.txt +++ b/docs/topics/http/sessions.txt @@ -166,7 +166,7 @@ and the :setting:`SECRET_KEY` setting. cookie backend might open you up to `replay attacks`_. Unlike other session backends which keep a server-side record of each session and invalidate it when a user logs out, cookie-based sessions are not invalidated when a user - logs out. Thus if an attacker steals a user's cookie, he can use that + logs out. Thus if an attacker steals a user's cookie, he or she can use that cookie to login as that user even if the user logs out. Cookies will only be detected as 'stale' if they are older than your :setting:`SESSION_COOKIE_AGE`. |