Re: PayPal security flaw

From: Todd H. (comphelp_at_toddh.net)
Date: 12/20/03 

Date: 20 Dec 2003 14:36:57 -0600

Barry Margolin <barmar@alum.mit.edu> writes:

> Unless you want to make the user go through the password entry page
> again, the authentication info has to be saved on the client machine
> somewhere.

Not true. You can save instead an authentication cookie that's tied
to a session table on the server. And the authentication cookie can
be hashed with the user's IP address, time of creation, and other
things to minimize the "portability" of that cookie to another remote
user.

The username and password should NOT be part of this cookie--only used
to get that cookie upon initial authentication. 

-- 
Todd H.
http://www.toddh.net/

Relevant Pages

  • Re: User.Identity.IsAuthenticated and requireSSL=true
    ... You have to run all pages that rely on authentication under SSL - on every request the authentication cookie is round-tripped and you don't that to be stolen or sniffed from the wire. ... back to http mode, User.Identity.IsAuthenticated becomes false again ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Web request with an existing cookie...
    ... My understanding is that it depends on the type of authentication you are ... The CrendentialCache is used to store login credentials for multiple ... can I pass an authentication cookie that all ready exists on my hard drive ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: can you prevent malicious use of browser back button in forms
    ... What I'm trying to ask here is how can you prevent a malicious user making use of the forms authentication cookie that hasn't yet expired due to a timeout? ... >> I have a Web App that uses forms authentication to secure sections. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Forms Authentication with Session State
    ... I have a login page that creates an encrypted ... Authentication Cookie. ... authenticated by matching credentials in SQL Server ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Expire Forms Authentication Ticket on Server Side
    ... The signout method is removing the forms authentication cookie from the ... copy of the cookie and send it in a request to our server and was able ... to gain entry up until the forms authentication ticket times out on its ...
    (microsoft.public.dotnet.framework.aspnet.security)