I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie. The web ...
I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
Firesheep has brought the issue of insecure cookie exchanges to the forefront. How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...