[cap-talk] solve CSRF by making references unforgeable, not unshareable

[Bill Frantz]

sam at samason.me.uk (Sam Mason) on Thursday, April 2, 2009 wrote:

>> My array is only as large as the maximum number of remotely accessible
>> objects that have ever existed. Keeping the array from growing indefinitely
>> is why the allocation count is included in the design.
>
>Wouldn't it be as large as the highest currently allocated client's
>index, or is my head still broken?

That approach is possible. There would need to have code which kept track
of what the highest currently allocated client's index is, which might be
more expensive than just keeping the storage. It seems to me the choice is
application dependent. :-)

Cheers - Bill

-----------------------------------------------------------------------
Bill Frantz        | I like the farmers' market   | Periwinkle
(408)356-8506      | because I can get fruits and | 16345 Englewood Ave
www.pwpconsult.com | vegetables without stickers. | Los Gatos, CA 95032