WebApp Sec mailing list archives
Re: Login credentials and session id security
From: Aman Raheja <araheja () techquotes com>
Date: Fri, 08 Jun 2007 09:55:45 -0500
Using Post method is considered more secure of the three options. You may encrypt the credentials at the client, with a script on the client browser. This won't make it completely resistant (when the proxy is sniffing and decrypting SSL, as per the scenario) but will increase the work factor because now the attacker has to get to the key and then decrypt to get the credentials. Session id is generally stored in the cookie. It should be random and cookie marked secure but given the proxy able to sniff, it can be compromised, in this setting. You may want to ensure other controls like expiring the session after certain time period. Also, you might want to include a detective control on your application, showing the user last time they logged in so that of anyone had stolen the credentials and used it, they could detect (agreed not all users pay attention but it's better than not having one) Regards Aman Raheja, CISSP http://www.techquotes.com Vishal Garg wrote:
Hi All, Can someone please tell what is the most secure way of sending login credentials to the server. The possible ways that I am familiar with are: - get method - post method - hidden form fields By using an encrypted connection we cannot sniff the credentials, but still it is very easy to capture or manipulate these credentials using a web proxy from any of these methods. So I am looking to find a method to transport the credentials to the server so that the security of these credentials can't be compromised even by deploying a web proxy. Also once a session id is generated, what is the best way to maintain the security of a session id. Any help would be much appreciated. Regards Vishal ------------------------------------------------------------------------- Sponsored by: Watchfire The Twelve Most Common Application-level Hack Attacks Hackers continue to add billions to the cost of doing business online despite security executives' efforts to prevent malicious attacks. This whitepaper identifies the most common methods of attacks that we have seen, and outlines a guideline for developing secure web applications. Download today! https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe --------------------------------------------------------------------------
-- --------------------------------------------- Aman Raheja Security+, Linux+ Certified. http://www.techquotes.com PGP Key http://www.techquotes.com/araheja.asc --------------------------------------------- ------------------------------------------------------------------------- Sponsored by: Watchfire The Twelve Most Common Application-level Hack Attacks Hackers continue to add billions to the cost of doing business online despite security executives' efforts to prevent malicious attacks. This whitepaper identifies the most common methods of attacks that we have seen, and outlines a guideline for developing secure web applications. Download today! https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe --------------------------------------------------------------------------
Current thread:
- Login credentials and session id security Vishal Garg (Jun 06)
- Message not available
- Re: Login credentials and session id security Scott C. Sanchez (Jun 08)
- Message not available
- RE: Login credentials and session id security Ken Schaefer (Jun 08)
- Re: Login credentials and session id security AdityaK (Jun 08)
- Re: Login credentials and session id security Aman Raheja (Jun 08)
- Re: Login credentials and session id security Dean H. Saxe (Jun 08)
- Re: Login credentials and session id security Aman Raheja (Jun 10)
- Re: Login credentials and session id security Dean H. Saxe (Jun 08)
- Re: Login credentials and session id security James Landis (Jun 08)
- Re: Login credentials and session id security David Wall (Jun 10)
- Message not available
- Re: Login credentials and session id security Vishal Garg (Jun 08)
- Re: Login credentials and session id security matt farey (Jun 10)
- Re: Login credentials and session id security Scott C. Sanchez (Jun 10)
- Re: Login credentials and session id security James Landis (Jun 11)
- Re: Login credentials and session id security Vishal Garg (Jun 08)
- <Possible follow-ups>
- Re: Login credentials and session id security Shaon Diwakar (Jun 08)