As far as I can tell "by logging out before delivering the data, he can render a... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

nieve on Nov 3, 2021 | parent | context | favorite | on: TLSNotary – Prove you received a webpage from a se...

As far as I can tell "by logging out before delivering the data, he can render any session cookies invalid" means that if you use this mechanism and forget to sign out partway through the process you're potentially handing over session cookies. This seems like a really unsafe design.

curtain on Nov 3, 2021 [–]

I think you hand them over regardless, the logout is to render them invalid.

I wonder how many sites neglect that part.

Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact