Re: URL-Rewriting, referer and https

On Jul 8, 7:21 pm, Tom Hawtin <use...@xxxxxxxxxxxxxxxxx> wrote:
samee...@xxxxxxxxx wrote:

What would be a good security mechanism if we remove referer check and
still keep using URL-rewriting? I guess, cookie based sessions are
also vulnerable to session hijacking but it is more difficult to steal
cookie. (Since it is not easily visible in URL, only option is to
sniff the network, guess the cookie value, or steal it from user's
computer)

Something else to be aware of is that you don't necessarily have to
steal a session in order to do something dodgy with it. If I send you to
a malicious page with some JavaScript in it, that can POST to a third
party website that you are logged into using cookies or HTTP auth. (In a
Java Applet/WebStart application, I should only be able to GET using
AppletContext.showDocument or similar.)

JavaScript is evil.

Tom hawtin

Our server is configured currently to use only URL rewriting method,
so it does not use cookies at all. So our site works fine without
cookies.
Now, moving jsessionid to a cookie would mean that site would not work
(or some links will not work if server falls back to URL rewriting and
referer is absent during a transition from https->http) when user
disables cookies in their browser.

Do you think moving to cookie based approach is a good idea? I think
there are lots of sites out there (gmail, yahoo mail, Circuit City,
Wells Fargo, ING Direct) that do not work without cookies.

Thanks,
Sameer

.

Relevant Pages

  • Re: Sessions vs Cookies
    ... There is a session cookie which simply allows the server to identify the client and retrieve relevant session data for it. ... If cookies can be read or forged, it makes little odds whether you have the master key or all the little keys,. ... Suppose you only send the PHPSESSID: Now you cannot change a thing on the server, even if you have the 'master key'. ...
    (comp.lang.php)
  • Re: session wont timeout
    ... Maybe this is a session cookie issue? ... client browser there is this one: WSS_KeepSessionAuthenticated Expires: At ... If I kill the session cookie using IE Developer Toolbar, ... possible and IIS would throw another challenge. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Is it safe to store user_id in Session?
    ... What I was wondering is how safe it is to store user_id or username or ... session so I do not need to search the database all the time. ... OVERRIDING BASIC SESSION COOKIE AUTHENTICATION ... So what is described in the article only works for bad php scripts. ...
    (comp.lang.php)
  • Chicken and egg issue with Cookie based login?
    ... I have few questions I hope someone can clear up for me with the cookie ... private web server. ... It also says this about the secret key: ... Second, would be an example of the "Session ID" or more general, what is an ...
    (comp.security.misc)
  • Re: [PHP] Question about authenticating people...
    ... Would I be better to store that in a cookie rather then a session variable? ... The search variable is not sensitive data, there's no need to keep it on the server so it's an ideal candidate for a cookie. ... Also bear in mind that the client can change the contents of a cookie at any time so you need to re-validate them on every page request. ... If you need to verify the contents of a cookie from request to request you can a) encrypt it, or b) add a checksum to it. ...
    (php.general)