3 ms·
Session hijacking only works on webpages with sessions. Most of these urls are static informational pages without sessions, from the several I looked at.
by jspaetzel 12y ago
Session hijacking only works on webpages with sessions. Most of these urls are static informational pages without sessions, from the several I looked at.
- JonathonW 12y agoThe WSJ specifically requires login to view articles (because they require an active subscription to read anything on their site). Most of the other newspaper sites (at least; not going to go and pick through the whole list) are the same, with different thresholds for when login is required.
- jspaetzel 12y agoI'm not sure what happens on the site after login on WSJ, if they are doing it semi-correctly then it should be a secure page after login. If that's not the case, then yea they should improve this. Not picking through them individually, there are a number of pages outside the newspaper category that are strictly informational without even login forms.