Tag Info

New answers tagged

1

You should HMAC the payload as well. Since you mentioned including a header with the HMAC of the path and query parameters, you could have a separate header that contains the HMAC of the body. However, you will likely only want one HMAC to be sent, so an attacker couldn't mix and match the different sections. Thus you could do something like this: ...


1

I think that an HMAC provides little added security if the session ID is something that is hard to guess. For example, a long secure PRNG. But if the session ID is simple to guess then there is the risk of session hijacking. As the expressjs framework allows you to provide a session ID creation function that returns IDs with unknown security properties, an ...


0

It is explained later in the documentation: If your interested in this module is to produce hashes to store passwords, then I strongly encourage you to use the hash function. The key derivation function does not produce any message authentication code to ensure integrity. You will also have to store the scrypt parameters separately. Lastly, there is no ...



Top 50 recent answers are included