Recent content by Reef

This attack may still be performed just after the client sends the token but before it decides that the login has \"timed out\" and failed. There is a window (and has to be in this architecture) where the malicious server is given time to verify the token. If it is enough time to log in and be...

if code is the server is requested is the same as the client supplied, the client is who he says he is. ...or it is an owner of a malicious server which has highjacked the cookie (code) when the client was trying to log in. The cookie should be stamped with the identity of the server which...

That is a fine engine feature, but how will it be actually used in the game?

\"b??dny argument\" means \"bad argument\". This bad argument, whatever it is, seems to be supplied to the java socket library. Perhaps you need to bind your server to a certain IP or something. It seems that your server is in NATted IP and your client is not - this might be the problem.