5 ms·

Well before we were simply sending the password and comparing with hash on server side, but a pentest team retrieved sent passwords from browser's memory (not e

Well before we were simply sending the password and comparing with hash on server side, but a pentest team retrieved sent passwords from browser's memory (not entirely sure how), so they recommended that we send hashed passwords. The random string which is part of session is to avoid replay attacks. But i suppose SSL should be taking care of it, right?

patio11 13y ago
... If you have arbitrary memory access on the browser's machine, your site's password is screwed no matter what you do, and that is very much not the most interesting thing to be done with that access. Your session management / CSRF token will take care of replay attacks without you having to worry about integrating that into your login page. If your sessions aren't secure against replays they can be replayed after the login anyhow.