[Zope-CMF] CookieCrumbler security issue?

[Chris Withers]

Lennart Regebro wrote:

> SSL? I don't really see the use in trying to create a completely new 
> secure authorization system. :)

Are there any situations where a cookie sent via SSL could be returned via 
normal HTTP?

> Good question, I timeout would be good. Maybe storing it in a session 
> variable?

Hmmm, now htere's an intersting idea. I've miss-used Session data containers 
like this in the past already ;-)

cheers,

Chris