4 ms·
* Don't let HTTP GET requests modify state, ever. It's very difficult to prevent CSRF via HTTP GET. * Session keys are password-equivalents. Hash them with bcr
by DrJokepu 10y ago
* Don't let HTTP GET requests modify state, ever. It's very difficult to prevent CSRF via HTTP GET.
* Session keys are password-equivalents. Hash them with bcrypt or something before you store them.
* httponly is not incredibly useful. If the attacker can run JavaScript on your page, you're in trouble.
- minitech 10y ago> Don't let HTTP GET requests modify state, ever. It's very difficult to prevent CSRF via HTTP GET. Isn’t it exactly as difficult as any other method? > Session keys are password-equivalents. Hash them with bcrypt or something before you store them. bcrypt is overkill, especially for something that has to be checked every request; just use any SHA-2 (non-iterated). A session key should be long enough by far to resist brute force.
- ufmace 10y ago> httponly is not incredibly useful. If the attacker can run JavaScript on your page, you're in trouble. Gotta disagree with that. Defense in depth is always a good idea. Don't ignore a simple security win just because it isn't necessary if all of your other security measures are working. Security is needed the most when some of your security measures have already failed.