Tag Info

New answers tagged

0

Reading http://tools.ietf.org/html/rfc6749#section-4.1.1, this is what I interpret: The client (in this case, the server with an account that Mallory is fixating) directs the user-agent to an OAuth request. state has been determined by the client, and is passed with the request, and will be passed back when the user-agent is sent to redirect_uri with an ...


2

How to avoid session fixation (Login CSRF) by MitM attack without HSTS? You can't. You need to have your site in the HSTS preloaded lists to avoid this type of MITM attack otherwise the attacker could MITM the first connection and set the session cookies to fixate it to the attacker's session. However, I cannot use HSTS because the same domain needs ...


2

Interesting question. What your are describing is an environment, where the attacker mounts a man-in-the-middle attack, where it can read and modify the users HTTP traffic but not HTTPS traffic. This excludes SSLStrip-like attacks and SSL man-the-middle so you might look here for ideas on how to detect these kind of attacks at the server. In the environment ...



Top 50 recent answers are included