Re: Advice on when to use SSL? esp. Session ID security

From: Patrice Scribe (scribe@chez.com)
Date: 04/04/03 

From: "Patrice Scribe" <scribe@chez.com>
Date: Fri, 4 Apr 2003 13:08:30 +0200

Cross Side Scripting should allow to stole this information. Besides
protecting your site against CSS you could also change this ID with each
round trip (I believe this is what IIS does for its own session identifier).

Anyway I'm afraid that security is a never ending process.

Patrice 

--
"Luke Arms" <linarms@yahoo.com> a écrit dans le message de news:
Xns935392ACABFD0linarmsyahoocom@61.8.0.29...
> Hi,
>
> I'm just trying to assess when/how much to use SSL encryption on an
ASP.NET
> site. Obviously I'll be using it on the login page, but what do people
> think about retaining SSL for the duration of the user's session? My
> primary concern is that although 'crackers' might be unable to get a
> username/password, they could possibly forge a session cookie after the
> user logs on and returns to a standard HTTP connection. To what extent
> should this be a genuine concern? Given the overhead of running an entire
> site over SSL if a user's logged on, it would be preferable to only use
> HTTPS for the login page ...
>
> Any comments?
>
> Thanks,
>
> Luke

Relevant Pages

  • session security
    ... Currently all of my php pages use SSL, not just my initial login. ... A leaked session id enables the third party to access all resources which are associated with a specific id. ...
    (comp.lang.php)
  • Re: Account Creation and Security
    ... If security is really an issue you should consider using SSL ... that is about the only way to protect session hijacking etc. ... NTLM is also pretty good but managing the accounts can be ... and letting users login using the login prompt in browsers and save ...
    (microsoft.public.dotnet.framework.aspnet)
  • Advice on when to use SSL? esp. Session ID security
    ... I'm just trying to assess when/how much to use SSL encryption on an ASP.NET ... they could possibly forge a session cookie after the ... user logs on and returns to a standard HTTP connection. ... HTTPS for the login page ... ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • OWA and SSL
    ... Is there a way to have SSL enabled for just the ... login of OWA, then, not use SSL for the rest of the session? ... Or is it advisable to keep SSL throughout the session? ...
    (microsoft.public.exchange.admin)
  • Re: Please! Doesnt anyone know a better way to do this?
    ... account, they need to automatically be directed to the page to enter data ... session variable on the Account page. ... I assume here that you're checking a database when the user attempts to ... When a new user attempts to login or clicks to register, ...
    (microsoft.public.dotnet.framework.aspnet)
Quantcast