Tag Info

New answers tagged

0

The servlet engine you are using securely handles session cookies when you call request.getSession(), and is not vulnerable to fixation. (as discussed in the comments) This behavior is both intentional and correct. Whether getSession(), getSession(true) or getSession(false) is called, the server relies on its own memory to determine if there is a valid ...


3

In the case of CRIME, the attack is on the client. Hostile Javascript in the client triggers requests to the server, that the attacker observes from the outside; and (that's the important point here) the attacker can block the outgoing request. The attacker needs to see the encrypted records, but not necessarily to let them go all the way to the server. ...


0

What you've described is very similar (almost identical) to the basics of the OpenPGP standard. It would be wise to read up on OpenPGP before attempting your own implementation of this scheme. To answer your question posed here: Here is where I am having trouble. If I decide the store a hash of the passphrase in the Session, then the server would ...



Top 50 recent answers are included