Oct 7, 2009, 21:36 by Anonymous
sounds good
Secure Cookies – Beyond SSL
Dustin Sweigart (Oct 21, 2009)
Talk at ZendCon 2009 Uncon (English - US)
Locked windows with an open door...
Security often focuses on the standard routines of protections against XSS, implementing ACL, scrubbing user input. What good is worrying about authorization when you haven't done enough in authentication? The first step in providing authorization is to adequately provide authentication, and using SSL alone isn't enough.
Using cookies intelligently can buy you a lot of things…
* Authentication without touching the DB every request
* High level confidentiality of stored data
* Modification detection
* Protection against common cookie attacks
Quicklink: http://joind.in/961
Comments
Oct 9, 2009, 19:22 by bjori
Given the fact php.net uses extremely insecure cookies (probably to 'not touch the database on every request'), I'd like to know how to fix it :)
Oct 12, 2009, 14:47 by Anonymous
Show us the way!
Oct 12, 2009, 16:41 by Anonymous
I'd like to see this one.
Oct 15, 2009, 17:55 by Anonymous
+1
Oct 6, 2009, 20:00 by Anonymous
I am definitely interested in this.