|
|
Posted by Roman on 06/12/07 03:09
iktorn wrote:
> howa napisał(a):
>> 1. For example, without SSL, If I capture my local LAN packet and
>> scanned the SESSION ID, is it possible to hijack the session?
>>
>
> unfortunately yes
>
>> 2. So any recommendation for web apps session handling without SSL?
>>
>
> - use very short session life time
> - force user to login again before doing something important
>
How about caching the initiating IP during session creation? Unless
potential hijacker is behind same NAT box, he will have have different
IP and should not be able to hijack.
Roman
Navigation:
[Reply to this message]
|