Comment by 8note

2 months ago

also assume that the valid credentials have been stolen and are being used by a hacker.

make sure anything done in a session can be undone as part of sanitizing the user