[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Expertise and Innovation - was Re: Non-Borg serve

  • Subject: Re: Expertise and Innovation - was Re: Non-Borg servers can authenticate Borg clients (Was Re: Re:Cookies at XML Europe 2004 -- Call for Participation)
  • From: Rick Marshall <rjm@z...>
  • Date: Thu, 05 Feb 2004 06:43:42 +1100
  • Cc: "'xml-dev@l... '" <xml-dev@l...>
  • In-reply-to: <4020FCE9.3030203@a...>
  • Organization: Zenucom Pty Limited
  • References: <Pine.LNX.4.44L0.0401100752020.21696-100000@s...> <4020FCE9.3030203@a...>
  • Reply-to: rjm@z...

borg serve
On Thu, 2004-02-05 at 01:08, Alaric B Snell wrote:

> And it's still the case that both users and programmers have less 
> control over HTTP auth; browsers still don't give you "logout" buttons 
> that uncache the username and password you've entered, the credentials 
> have to be submitted with every request rather than just once (widening 
> the window of vulnerability to snooping), the server cannot enforce that 
> sessions expire after a certain period of inactivity (and sometimes they 
> will *need* to mandate that to meet the requirements of banking 
> applications and so on, regardless of user browser choices and 
> settings), and so on.
> 
but my commonwealth bank site does time out sessions and so does
qantas... isn't this an application problem rather than browser problem

after time x (10/20 minutes of inactivity) i have to log in again. seems
to me it wouldn't be too hard (though possibly inconvenient to users) to
have absolute timeouts as well.

and the sessions are encrypted, and the keys are generated for every
session... how much more secure do you need?

rick

> ABS
> 
> 
> -----------------------------------------------------------------
> The xml-dev list is sponsored by XML.org <http://www.xml.org>, an
> initiative of OASIS <http://www.oasis-open.org>
> 
> The list archives are at http://lists.xml.org/archives/xml-dev/
> 
> To subscribe or unsubscribe from this list use the subscription
> manager: <http://lists.xml.org/ob/adm.pl>
> 


PURCHASE STYLUS STUDIO ONLINE TODAY!

Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
Email
First Name
Last Name
Company
Subscribe in XML format
RSS 2.0
Atom 0.3
 

Stylus Studio has published XML-DEV in RSS and ATOM formats, enabling users to easily subcribe to the list from their preferred news reader application.


Stylus Studio Sponsored Links are added links designed to provide related and additional information to the visitors of this website. they were not included by the author in the initial post. To view the content without the Sponsor Links please click here.

Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.