Re: [PEN-TEST] HTTP Secure Session State Management

[Drew Simonis <simonis () myself com>]

Mark Curphey wrote:
> IMHO - Hidden Form Fields, isn't that like security by obscurity (maybe I
> don't understand how they work right) ? Sure you can set the no cache option
> in the http header but doesn't the session status ID (whatever you pass as
> the form field value) just sit on the client machine ready to be replayed ?

No, the point that Robert was making (which is a good one) is that
sometimes the URL, with the appended sessionid, might be logged to
another server.  In cases where the HTTP_REFERER is logged, hidden
fields wouldn't be captured, since they aren't part of the URI.

Alas, your point is also valid.  Hidden fields are generally no
more a secure solution than a GETish URI when used by itself.
My earlier point (added to by Philip) is still, IMO, the best
bet.  Make sure whatever information you use to maintain state
is of little use later in life.  Your main concerns are not only
the danger of a replay attack, but also of information leaks.  Both
nasty things to have to deal with...