![]() |
![]() |
|
Current Projects: PHP on XP Guide — NFO Viewer — Easy Reflections — Photon Storm — HotWire — FileGlider
Thursday, November 3. 2005From A to B via XTTrackbacks
Trackback specific URI for this entry
No Trackbacks
Comments
Display comments as
(Linear | Threaded)
what i feel is if we let the user know that whether his userid or password is wrong then an unauthorised user can try a combination of things .... if we display the message "Username/Password invalid", then the unauthorised user will not be able to guess that whether the userid is incorrect or the password ....
what you say, please let me know
I will have to disagree with this one - I feel that sites should be built for the user first, and a 'hacker' second. Most of the time a hacker could determine if the username was valid by using one of those 'send me my password' features - often all they do is take the username and then send out an email. The hacker can use this to determine if the username is valid. Ilia's book on security has a great chapter on tar pits, something you should use to trap your hackers rather than annoy your visitors.
thanks richard,
you are right that the user name can be known by other ways also .. i agree
Watch out for those redirects...last time I checked Header("Location: $xyz"); always gave a 302 response which it shouldn't - most browsers do not implement HTTP properly in this regard both for HTTP 1.0 and 1.1 - indeed the behaviour is deeply ingrained into many development toolkits (and not just PHP ones) the result is that it *works* but its not correct.
If the protocol is 1.1 (or later) you should really issue a 303 redirect. See http://ppewww.ph.gla.ac.uk/~flavell/www/post-redirect.html This may seem like nit picking, but given the exploitation of redirection for phishing attacks, this is an area which may see changes (or 'bolt-ons' claining to improve security). C. |
QuicksearchCategoriesMy AS3 Blog
Photon Storm Great PHP links
C7Y PHP Podcast CorePHP is hosted by |