WebApp Sec: Re: Securing password between webserver & appserver.

[Robert Hajime Lanning <robert.lanning () gmail com>]

On Mon, Sep 7, 2009 at 7:04 AM, Chintan Oza<chintan.oza () gmail com> wrote:
> Browser<-HTTPS->WebServer<-->AppServer
>
> We have a requirement where password should not be available to the
> WebServer (even in hashed format).
CHAP should work just fine.  Just make sure the challenge is randomly generated.

-- 
And, did Galoka think the Ulus were too ugly to save?
                                         -Centauri