meta user
network profile
| bio | website | careers.stackoverflow.com/… |
|---|---|---|
| location | Seattle, WA | |
| age | 32 | |
| visits | member for | 2 years, 2 months |
| seen | May 22 at 2:23 | |
| stats | profile views | 11 |
I'm a web application developer turned IT manager with fifteen years of experience building everything from comprehensive ERP systems to 50-LOC chat rooms.
I'm a proud member of the New Tag Deletionist Cabal.
|
Dec 5 |
awarded | Citizen Patrol |
|
Dec 5 |
awarded | Critic |
|
Sep 6 |
awarded | Autobiographer |
|
Aug 20 |
awarded | Caucus |
|
Apr 24 |
awarded | Enlightened |
|
Apr 24 |
awarded | Nice Answer |
|
Apr 24 |
awarded | Yearling |
|
Apr 24 |
comment |
Why is passing the session id as url parameter insecure? You are more than welcome to provide your own answer, if you find mine lacking. I speak from extensive experience in the real world, not just from a purely security-oriented point of view. When supporting applications designed before developers understood the implications of such things, accidental session identifier passing was a far more visible, far more troublesome thing than the actual attack vector it presents. Now that it's well-understood to be an attack vector, steps must be taken to mitigate it. |
|
Apr 24 |
comment |
Why is passing the session id as url parameter insecure? @Rook, I prefer constructive feedback to downvotes. I've added a reference to session fixation attacks. |
|
Apr 24 |
revised |
Why is passing the session id as url parameter insecure? added 199 characters in body |
|
Apr 23 |
comment |
Why is passing the session id as url parameter insecure? And of course, neither is true if your browser is configured to either not save history/cookies or it's running in a privacy mode. However, that won't stop MitM attacks over unencrypted channels, and is only a minor barrier to spyware or malware attached to the browser from spying anyway. |
|
Apr 23 |
awarded | Teacher |
|
Apr 23 |
answered | Why is passing the session id as url parameter insecure? |
|
Sep 5 |
revised |
Is using HMAC to transmit a password OK? No need to @somebody in an answer, especially when that somebody is the OP. |
|
Sep 5 |
suggested | suggested edit on Is using HMAC to transmit a password OK? |
|
Aug 22 |
awarded | Editor |
|
Mar 11 |
awarded | Supporter |
