You're on stage re: data leakage and this should be a significant thought for anyone rolling their very own authentication/authorization scheme. +one for mentioning OWASP. This is as simple as it gets, but is usually incriminating when there is even a slight blunder. A destructive hacker should be careful to http://pigpgs.com