Tag Info

New answers tagged

0

Remove all unnecessary information from the URL (e.g. http://, the name of the site, etc.). If you have several options (e.g. five sites), use their index. Calculate a hash of what remains using a server-side secret salt and prepend it (or a part of it - the shorter it is, the greater the danger of a successful collision attack) to returnUrl Upon receiving ...


2

Sensitive information should never be transmitted using GET requests. The main reason is that users sometimes send links to eachother. Your system will probably fail to detect it when clients are behind a NAT router or a proxy. If you are using sessions you might as well restart using cookies. I'm not really sure why you would need to put the session in the ...



Top 50 recent answers are included