Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



WebApp Sec: Re: improvements in session management?

Re: improvements in session management?

From: dd <dd_at_ghettohackers.net>
Date: Thu, 01 Apr 2004 13:45:22 -0800

Michael Ströder wrote:

> dd wrote:
>
>>
>> This could include checking things like user agent, acceptable
>> languages, but better by adding data that changes on each request via
>> cookie, form field, etc (call this the SINGLEUSEID).
>
>
> I see some problems with the usability (browser's back-button and
> concurrent HTTP requests for images) when implementing session IDs which
> are only valid for the next hit.
>

For the use of a querystring or forms variable, yes. However in the
case of a cookie things should work fine, even with back button since
the new cookie will be transfered.

dd
Received on Apr 01 2004

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]