415 reputation
48
bio website careers.stackoverflow.com/…
location Eugene, OR
age 33
visits member for 3 years, 4 months
seen 2 days ago

I'm a web application developer turned IT manager with fifteen years of experience building everything from comprehensive ERP systems to 50-LOC chat rooms.

I'm a proud member of the New Tag Deletionist Cabal.


May
30
awarded  Yearling
Jan
30
awarded  Good Answer
Dec
5
awarded  Citizen Patrol
Dec
5
awarded  Critic
Sep
6
awarded  Autobiographer
Aug
20
awarded  Caucus
Apr
24
awarded  Enlightened
Apr
24
awarded  Nice Answer
Apr
24
awarded  Yearling
Apr
24
comment Why is passing the session id as url parameter insecure?
You are more than welcome to provide your own answer, if you find mine lacking. I speak from extensive experience in the real world, not just from a purely security-oriented point of view. When supporting applications designed before developers understood the implications of such things, accidental session identifier passing was a far more visible, far more troublesome thing than the actual attack vector it presents. Now that it's well-understood to be an attack vector, steps must be taken to mitigate it.
Apr
24
comment Why is passing the session id as url parameter insecure?
@Rook, I prefer constructive feedback to downvotes. I've added a reference to session fixation attacks.
Apr
24
revised Why is passing the session id as url parameter insecure?
added 199 characters in body
Apr
23
comment Why is passing the session id as url parameter insecure?
And of course, neither is true if your browser is configured to either not save history/cookies or it's running in a privacy mode. However, that won't stop MitM attacks over unencrypted channels, and is only a minor barrier to spyware or malware attached to the browser from spying anyway.
Apr
23
awarded  Teacher
Apr
23
answered Why is passing the session id as url parameter insecure?
Sep
5
revised Is using HMAC to transmit a password OK?
No need to @somebody in an answer, especially when that somebody is the OP.
Sep
5
suggested suggested edit on Is using HMAC to transmit a password OK?
Aug
22
awarded  Editor
Mar
11
awarded  Supporter