3 ms·
If it were possible to pass the cookie on an encrypted channel but the content of the web page unencrypted this would match most people's idea of how it works.
by whakojacko 16y ago
If it were possible to pass the cookie on an encrypted channel but the content of the web page unencrypted this would match most people's idea of how it works. Unfortunately that's not the case.
Has there even been any attempt to standardize something like this? This problem certainly isn't a new one, so I would have guessed this had been looked into before
- pornel 16y ago> Has there even been any attempt to standardize something like this? Yes. HTTP Digest authentication is an "encrypted cookie". The problem is that it only protects against passive sniffing. Attacker able to inject packets can bypass it (e.g. replace Digest with Basic auth.)