WebApp Sec: RE: Securing password between webserver & appserver.

["Martin O'Neal" <martin.oneal () corsaire com>]

> Or why not bypass the webserver altogether 
> for auth if itisnt trusted. Send credentials 
> directly to the app server, that is assuming 
> the app server is publicly accesible.
Yup, would work. However, it would be a novel situation in which the
credentials were sensitive, but the data was not.

I would personally be trying to resolve the untrusted web server
situation...

Martin...