RE: Should login pages be protected by SSL?

I generally stick in some server side code that checks for the use of ssl on
pages that need it.  One library function applied to all pages that need it
can force the use of ssl on all of those pages...no worries about people
messing with client side tags or code.

-----Original Message-----
From: Saqib Ali [mailto:docbook.xml@gmail.com] 
Sent: Monday, June 27, 2005 9:38 AM
To: Michael Tsentsarevsky
Cc: webappsec@securityfocus.com
Subject: Re: Should login pages be protected by SSL?

> Could you explain for me what the insecurity is in REFRESH meta tags?

I have nothing against META REFRESH :) . It is just that using them
for redirecting the users from http:// to https:// is a bad bad
design. The Meta referesh tag can be intercepted, or stopped
completely. Plus, the execution of the META tags depends on the
browser, and not the server.

You would have to make sure that you put REFERESH on all the web pages
for something that can be easily done using one URL rewrite statement
on the webserver.

-- 
In Peace,
Saqib Ali
http://www.xml-dev.com/