Beefy Boxes and Bandwidth Generously Provided by pair Networks
There's more than one way to do things

Re: Re: Check the cookie for changes

by drewbie (Chaplain)
on Mar 25, 2002 at 16:02 UTC ( #154128=note: print w/replies, xml ) Need Help??

in reply to Re: Check the cookie for changes
in thread Web based password management (or how *not* to blame tye)

True, that would work fine if all you're storing in the cookie is the session id. I usually put a little more in the cookie than just the id, so using a hash to verify the value I put there is second nature to me.

Here's a scenario: User A get a cookie w/ the session and logs into a web app w/ sensitive data. User B has access to User A's computer (hacker, social engineering, etc) and gets the session ID. User B then creates a session cookie like User A's, and now he can see the sensitive data he should not have access to. Using a checksum on the cookie value can help to avoid situations like this. And there really is not a downside. You write the code once, it uses C based modules so it's fast, and you prevent one less possible security problem. Maybe you'll never run across this situation, but should you do so you don't have to worry.

Just a thought...

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://154128]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others about the Monastery: (4)
As of 2019-08-24 18:13 GMT
Find Nodes?
    Voting Booth?

    No recent polls found