3 ms·
It would have needed some extension for a session id, so the browser isn't just sending the password with reach request. Even with HTTPS I feel this is an unnec
by iforgotpassword 7y ago
It would have needed some extension for a session id, so the browser isn't just sending the password with reach request. Even with HTTPS I feel this is an unnecessary risk, since if you compromise the server you don't need to wait for login requests, but just any kind of request. Other than that I'd actually consider using this for side projects (should they ever be web based and require authentication).
- chopin 7y agoThe session (or any auth) cookie is essentially the same as sending your password. Security wise there's no big difference between sending a password or a session cookie over https (other than the session cookie is short lived, which may have its merits).
- notriddle 7y agoUsing a session cookie about as important as using a salted hash for the database side; it's a mitigation for password reuse.