On Thu, 10 Jan 2008 10:26:08 -0600
Ron <ronlists@skullsecurity.com> wrote:
Somebody here is developing a Web application that requires user
logins, but that is unable to store session information on the server
(don't ask me why, it's a long story). So here's what they propose:
Sorry, I can't help but to probe into the matter. If "somebody" is
creating a web application that requires user login, then that somebody
needs some way to store information on some kind of database on the
server, usernames, passwords etc. You cannot store this information on
the client side for later validation.
to take the username, hash of the password, and date the user logged
in, encrypt them with a strong encryption algorithm, and store them
in a cookie (along with a hash to ensure integrity).
"to take the username" if not stored on the server from where then?
What do you want to accomplish with this?
If you cannot store any information of any kind on the server, the
information that you store in a cookie is rather worthless.
Perhaps I have misunderstood you.
My question is, assuming a proper encryption algorithm/eky are
chosen, can anybody think of a problem that this will create that
sessions don't already have (namely, replay attacks)?
I've thought about this for over a day, and I can't think of any
obvious problems, but I could be missing something.
Thanks!
Ron
-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web
application security assessments should be considered a crucial phase
in the development of any web application. What methodology should be
followed? What tools can accelerate the assessment process? Download
this Whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------
-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web
application security assessments should be considered a crucial phase in the
development of any web application. What methodology should be followed? What
tools can accelerate the assessment process? Download this Whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------
