Re: Login credentials and session id security

[Javier Fernández-Sanguino <jfernandez () germinus com>]

David Wall dijo:
> Keep in mind that hidden input fields are visible to the user (view page 
> source), so if it's their credentials, then no problem, but they can be 
> viewed and re-used if that's a design issue.

Notice that hidden input fields might also be stored locally on the 
client side, which means that they might be visible even if the browser 
has exited. Swap areas and browser's caches can be a way to extract 
these hidden input fields even if the user is no longer working at the 
system. Caching is implemented client-side and the server can only "try" 
to force the client to not cache data (setting the corresponding Pragma: 
in the HTTP header or the HTML document) but some clients might not 
enforce this properly and leave your content right there, in the 
client's hard disk after they have exited their session.

Regards

Javier

-------------------------------------------------------------------------
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have seen, 
and outlines a guideline for developing secure web applications. 
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------