Nytro Posted December 6, 2011 Report Share Posted December 6, 2011 Weaning the Web off of Session CookiesMaking Digest Authentication ViableVersion 1.0Timothy D. MorganJanuary 26, 2010ContentsAbstract...........................................................................................................................................................1Introduction....................................................................................................................................................1Cookie-based Session Management.............................................................................................................1HTTP Digest Authentication.......................................................................................................................2RFC 2069 Mode................................................................................................................................................................................2auth Mode..........................................................................................................................................................................................2auth-int Mode....................................................................................................................................................................................3Comparison....................................................................................................................................................3Pitfalls of Cookie-based Sessions..................................................................................................................................................3Limitations of Digest Authentication...........................................................................................................................................5Comparison Summary.....................................................................................................................................................................6Possible Solutions...........................................................................................................................................8Form-based HTTP Authentication...............................................................................................................................................8Approaches for Logout...................................................................................................................................................................9Practical Concerns.......................................................................................................................................11Immature Digest Implementations.............................................................................................................................................11Weak User Interfaces for HTTP Authentication....................................................................................................................11Application Server Support.........................................................................................................................................................13Conclusion....................................................................................................................................................14Acknowledgements.....................................................................................................................................14References.....................................................................................................................................................15Download:http://vsecurity.com/download/papers/WeaningTheWebOffOfSessionCookies.pdf Quote Link to comment Share on other sites More sharing options...
