Re: Cookie stealing and replay in a corporate single sign on environment

[Saqib Ali <docbook.xml () gmail com>]

> > -- Web single sign-on typically works using a shared cookie that is
> > passed to all intranet web sites in the corporate domain (e.g.
> > *.myintranet.com).  Because these cookies are passed to ALL internal
> > web sites, there are plenty of opportunities for these cookies to be
> > stolen:

Any SSO that uses domain wide cookies, has inherent security issues
(e.g CSRF). Try SPNEGO <
http://www.xml-dev.com/blog/index.php?action=viewtopic&id=133 >
instead. SPNEGO provides a SSO for web based apps in a KERBEROS
enabled environment. Basically it allows web applications to
automatically authenticate clients who have valid Kerberos
credentials.

-- 
In Peace,
Saqib Ali
http://www.xml-dev.com/