[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/Products/Sessions/stresstests - stresstestMultiThread.py:1.5

[Casey Duncan]

On Wednesday 21 August 2002 10:36 am, Chris McDonough wrote:
> Here's what I have so far in the Zope Book regarding session security.=20
> Expansions?:
>=20
>     Security Considerations
>=20
>       Sessions are insecure by their very nature.  If an attacker gets
>       a hold of someone's browser id, and if they can construct a
>       cookie or use form elements or URL elements to pose as that user
>       from their own browser, they will have access to all information
>       in that user's session.  Sessions are not a replacement for
>       authentication for this reason.
>=20
>       Ideally, you'd like to make certain that nobody but the user its
>       intended for gets a hold of his browser id.  To take steps
>       in this direction, and if you're truly concerned about security,
>       you will ensure that you use cookies to maintain browser id
>       information, and you will secure the link between your users and
>       your site using SSL.  In this configuration, it is more
>       difficult to "steal" browser id information as the browser id
>       will not be evident in the URL and it will be very difficult for
>       attackers to "tap" the encrypted link between the browser and
>       the Zope site.

Not if they use IE, but that's another story ;^). Officially categorized =
as=20
"not our fscking problem".

-Casey