WebApp Sec: Re: Problems with most web app auth schemes

[<webappsec () technicalinfo net>]

After reading through alot of postings on this thread, I would suggest the following two relevant papers that go into 
some depth on the issues including recommendations:

Custom HTML Authentication - Best Practices on Securing Custom HTML Authentication Procedures - 
http://www.technicalinfo.net/papers/CustomHTMLAUthentication.html


Web Based Session Management - Best Practices in Managing HTTP Based Client Sessions - 
http://www.technicalinfo.net/papers/WebBasedSessionManagement.html