WebApp Sec mailing list archives
RE: Login credentials and session id security
From: "Ken Schaefer" <Ken () adOpenStatic com>
Date: Thu, 7 Jun 2007 20:38:52 +1000
Hi, GET and POST are just HTTP verbs (i.e. ways that the browser can communicate with the server). A hidden form field is just part of your HTML document. Neither of which is any more secure than the other, because none of these is specifically geared towards being an authentication mechanism, or a security mechanism. Instead, they are geared towards transporting data between your browser and webserver. What you are trying to do is say that certain data is "sensitive" and that you don't want that compromised. Well, HTTP and HTML doesn't really provide for any such distinction between sensitive data, and non-sensitive data. So, what are your options? Now, SSL/TLS is a security mechanism. It's designed to encrypt data, and protect against man-in-the-middle attacks. That allows you to send data using a GET/POST request, without worrying too much about attacks on the data in-transit (you still need to secure the endpoints). Alternatively, you can look at robust authentication technologies (e.g. Kerberos, Client Certificates) that are designed to provide a secure authentication mechanism (obviously your HTTP data isn't protected). Cheers Ken -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Vishal Garg Sent: Wednesday, 6 June 2007 7:42 PM To: webappsec () securityfocus com Subject: Login credentials and session id security Hi All, Can someone please tell what is the most secure way of sending login credentials to the server. The possible ways that I am familiar with are: - get method - post method - hidden form fields By using an encrypted connection we cannot sniff the credentials, but still it is very easy to capture or manipulate these credentials using a web proxy from any of these methods. So I am looking to find a method to transport the credentials to the server so that the security of these credentials can't be compromised even by deploying a web proxy. Also once a session id is generated, what is the best way to maintain the security of a session id. Any help would be much appreciated. Regards Vishal ------------------------------------------------------------------------- Sponsored by: Watchfire The Twelve Most Common Application-level Hack Attacks Hackers continue to add billions to the cost of doing business online despite security executives' efforts to prevent malicious attacks. This whitepaper identifies the most common methods of attacks that we have seen, and outlines a guideline for developing secure web applications. Download today! https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe --------------------------------------------------------------------------
Current thread:
- Login credentials and session id security Vishal Garg (Jun 06)
- Message not available
- Re: Login credentials and session id security Scott C. Sanchez (Jun 08)
- Message not available
- RE: Login credentials and session id security Ken Schaefer (Jun 08)
- Re: Login credentials and session id security AdityaK (Jun 08)
- Re: Login credentials and session id security Aman Raheja (Jun 08)
- Re: Login credentials and session id security Dean H. Saxe (Jun 08)
- Re: Login credentials and session id security Aman Raheja (Jun 10)
- Re: Login credentials and session id security Dean H. Saxe (Jun 08)
- Re: Login credentials and session id security James Landis (Jun 08)
- Re: Login credentials and session id security David Wall (Jun 10)
- Message not available
- Re: Login credentials and session id security Vishal Garg (Jun 08)
- Re: Login credentials and session id security matt farey (Jun 10)
- Re: Login credentials and session id security Scott C. Sanchez (Jun 10)
- Re: Login credentials and session id security James Landis (Jun 11)
- Re: Login credentials and session id security Vishal Garg (Jun 08)