Using Post method is considered more secure of the three options. You
may encrypt the credentials at the client, with a script on the client
browser. This won't make it completely resistant (when the proxy is
sniffing and decrypting SSL, as per the scenario) but will increase the
work factor because now the attacker has to get to the key and then
decrypt to get the credentials.
Session id is generally stored in the cookie. It should be random and
cookie marked secure but given the proxy able to sniff, it can be
compromised, in this setting. You may want to ensure other controls like
expiring the session after certain time period.
Also, you might want to include a detective control on your application,
showing the user last time they logged in so that of anyone had stolen
the credentials and used it, they could detect (agreed not all users pay
attention but it's better than not having one)
Regards
Aman Raheja, CISSP
http://www.techquotes.com
Vishal Garg wrote:
Hi All,
Can someone please tell what is the most secure way of sending login
credentials to the server. The possible ways that I am familiar with are:
- get method
- post method
- hidden form fields
By using an encrypted connection we cannot sniff the credentials, but
still it is very easy to capture or manipulate these credentials using a
web proxy from any of these methods. So I am looking to find a method to
transport the credentials to the server so that the security of these
credentials can't be compromised even by deploying a web proxy.
Also once a session id is generated, what is the best way to maintain
the security of a session id.
Any help would be much appreciated.
Regards
Vishal
-------------------------------------------------------------------------
Sponsored by: Watchfire
The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online
despite security executives' efforts to prevent malicious attacks. This
whitepaper identifies the most common methods of attacks that we have
seen, and outlines a guideline for developing secure web applications.
Download today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------
--
---------------------------------------------
Aman Raheja
Security+, Linux+ Certified.
http://www.techquotes.com
PGP Key http://www.techquotes.com/araheja.asc
---------------------------------------------
-------------------------------------------------------------------------
Sponsored by: Watchfire
The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online
despite security executives' efforts to prevent malicious attacks. This
whitepaper identifies the most common methods of attacks that we have seen,
and outlines a guideline for developing secure web applications.
Download today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------
