4 ms·
Performance would be another benefit, wouldn't it? Password hashing algorithms are deliberately slow, so doing it for every request adds some overhead compared
by ptx 5y ago
Performance would be another benefit, wouldn't it? Password hashing algorithms are deliberately slow, so doing it for every request adds some overhead compared to doing it once and establishing a session ID. (Assuming that the passwords are hashed on the server.)
- jaywalk 5y agoNobody's hashing a password on every request. In this case, the cookie is used for a (very shoddily implemented) "Remember Me" feature, so the user doesn't have to login to the website every time they use it.
- ptx 5y agoIf you're sending the password in plaintext with every request and using it for authentication (e.g. using HTTP basic authentication) you're essentially logging in with every request, so you will have to hash the password in order to validate it, unless you're storing it in plaintext on the server as well.
- Fatnino 5y agoYou have a session like normal websites do and ignore the plaintext password in the cookie. Only the login page ever uses the cookie stored password in the rare instance the user got logged out by mistake. Basically, Lenovo reimplemented a basic browser feature that is supposed to just work locally and made it stupid.
- ptx 5y agoI see, thanks for clarifying. My reply was in reference to the "benefits of using a session over the raw password" and HTTP basic authentication more generally, so if Lenovo are using sessions it doesn't apply in this particular case.