Beefy Boxes and Bandwidth Generously Provided by pair Networks
Welcome to the Monastery

Re: Secure way of passing variables between forms

by davis (Vicar)
on Dec 27, 2005 at 21:36 UTC ( #519426=note: print w/replies, xml ) Need Help??

in reply to Secure way of passing variables between forms

Two of the variables are the users username and password which i do not want to put in 'hidden' fields as this is not very secure
Eh? define "secure"... Does it mean that no-one will ever, ever be able to find out that information? or does it mean that it would never be worth anyone's while to find out that information?

To be honest, I think you're thinking in the wrong direction. You would certainly want to minimize the traffic of the users' names and passwords (ie never send the information more than once), and you should encrypt information while it's in transit (ie use SSL). The differences in security of HTML hidden fields and any other type of (HTTP) transmission I can think of are minimal.

The normal (and probably "best") way of doing it is something like this: offer the users an HTML form over SSL, in which they enter their identifying information -- their authentication -- you then check the supplied credentials, assign privileges -- their authorization -- and give the user a token (often an HTTP cookie) which you can verify to be correct and unmolested (eg via cryptographic signatures). That way, the username and password is only entered and passed once, and you check the validity of the cookie at each subsequent stage.

That's enough parentheses for one post... happy new year.

Kids, you tried your hardest, and you failed miserably. The lesson is: Never try.
  • Comment on Re: Secure way of passing variables between forms

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://519426]
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others contemplating the Monastery: (7)
As of 2018-06-19 18:39 GMT
Find Nodes?
    Voting Booth?
    Should cpanminus be part of the standard Perl release?

    Results (114 votes). Check out past polls.