Re: [PEN-TEST] HTTP Secure Session State Management

["St. Clair, James" <JStClair () VREDENBURG COM>]

Probably being one of the slower guys here, let me see if I can summarize:

- Use an SSL required URL where http:// cannot be substituted.
- Set up a client/server where the server provides a MD5 hash-encrypted
session ID, that facilitates session regardless of the proxy/NAT.

This discussion is timely - I'm working on an SSL site now, where the
primary users are on load balancers that mandate proxies to maintain SSL
session states because the IP address switch ups.

Jim




-----Original Message-----
From: van der Kooij, Hugo [mailto:Hugo.van.der.Kooij () CAIW NL]
Sent: Wednesday, December 27, 2000 8:12 AM
To: PEN-TEST () SECURITYFOCUS COM
Subject: Re: [PEN-TEST] HTTP Secure Session State Management


On Tue, 26 Dec 2000, Thomas Reinke wrote:

> Philip Stoev wrote:
>
> > > Something like an MD5 hash is pretty good for this.  Perhaps
> > > a hash of the user's first and last name, address and the record ID.
> >
> > The IP address must always be a part of the session ID, and must be
checked
> No...that won't work. There are numerous users (few compared to the
> whole,
> but enough that it needs to be covered) that sit behind round robining
> proxy/NAT devices. This means the same user that in one second comes in
> as one IP address will come on the request as a second IP address.
> You could of course restrict the IP check to the same class C (until
> you find someone that has the proxy across multiple class C's...)

If this would happen I would considere that proxy to be broken. The client
IP address is a definite requirement to verify.

Hugo.

--
Hugo van der Kooij; Oranje Nassaustraat 16; 3155 VJ  Maasland
hvdkooij () caiw nl     http://home.kabelfoon.nl/~hvdkooij/
--------------------------------------------------------------
This message has not been checked and may contain harmfull content.