Beefy Boxes and Bandwidth Generously Provided by pair Networks
There's more than one way to do things

Answer: Login and CGI security problem.

by httptech (Chaplain)
on May 12, 2000 at 15:23 UTC ( #11262=categorized answer: print w/replies, xml ) Need Help??

Q&A > CGI programming > Login and CGI security ("open cookie jar") problem. - Answer contributed by httptech

It sounds like you're talking about the IE "open cookie jar" bug. If you're using IE, this could happen to you I suppose. It's definitely not a good thing to store usernames and passwords in cookies, but a lot of sites do it anyway.

The way I handle this problem is by using Apache's built in authentication modules. There's no information a hostile site could get from your browser (well, I don't know, IE seems to like to save passwords).

Anyway, the nice thing about letting Apache do the authentication step for you is that your scripts can just concentrate on the task at hand, instead of worrying about any holes you might have left in your authentication method. All you have to do is retrieve the $ENV{'REMOTE_USER'} variable and you can be pretty sure that's who you're dealing with.

  • Comment on Answer: Login and CGI security problem.
Log In?

What's my password?
Create A New User
and the grasshoppers chirp...

How do I use this? | Other CB clients
Other Users?
Others imbibing at the Monastery: (10)
As of 2018-01-16 16:36 GMT
Find Nodes?
    Voting Booth?
    How did you see in the new year?

    Results (183 votes). Check out past polls.