[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Participation

• To: Elliotte Rusty Harold <elharo@m...>
• Subject: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• From: Rich Salz <rsalz@d...>
• Date: Mon, 05 Jan 2004 14:00:22 -0500
• Cc: Edd Dumbill <edd@u...>, David Kunkel <DKunkel@i...>,XML-DEV <xml-dev@l...>
• In-reply-to: <p06010207bc1f5c8d8c6f@[192.168.254.4]>
• References: <p06010205bc1f30963822@[192.168.254.4]> <1073317356.8730.123.camel@saag> <p06010207bc1f5c8d8c6f@[192.168.254.4]>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

> Why do sites insist on using cookies for user authentication?

HTTP auth requires SSL for all connections or else passwords can be 
stolen -- do you include that in your "setup in 5 minutes" overhead? 
With cookies, you only need SSL on the login page if you make the cookie 
be an opaque ID into server state that has a time-out.  In general, 
login cookies are more secure with less overhead.

Secondarily, I don't know what the cookie is used for, but perhaps they 
intend to eventually (or in have previously done this) support some kind 
of session or login state; cookies are a natural for that (cf the title 
of the cookie RFC).  Even if all that you're doing is avoiding 
re-verifying the password, that could be enough state to make a cookie 
reasonable.

	/r$
-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html

• Follow-Ups:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: jcowan@r...
  • Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
    • From: Eric van der Vlist <vdv@d...>

• References:
  • Cookies at XML Europe 2004 -- Call for Participation
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Edd Dumbill <edd@u...>
  • Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Elliotte Rusty Harold <elharo@m...>

• Prev by Date: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Next by Date: Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
• Previous by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Next by thread: Re: Re: Cookies at XML Europe 2004 -- Call forParticipation
• Index(es):
  • Date
  • Thread