Re: Cookie Persistance

Quoting Kenneth Salchow <[email protected]>:

> Content-Type: text/plain;
> 	charset="iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
>
> BTW--you might also want to see if you can apply encryption to those cookies
> at the ADC--whether generated by the ADC or the server.  Especially if
> you're using something like JSessionID from the server.  It's a fairly
> simple thing that can dramatically increase your overall security posture.
>

I have to jump in here... Encrypted cookies are (Or should be) a  
complete waste of time.

If you follow the guidelines of basic best practice and security, any  
cookie content SHOULD be an opaque key. With no actual data in it. Any  
cookies you set in an HTTPS session should also be set as a secure  
cookie so it is never presented across an http session (To prevent  
cookie stealing).

Good security practices start with a healthy dose of paranoia. If  
there's no data in a cookie there's only the 'key' aspect of it to  
take care of (i.e. it doesn't matter if someone steals an opaque  
session id a week later. The session has expired therefore the session  
data will no longer be on the server. The data is only vulnerable  
until it expires. But a session cookie that includes data is  
vulnerable forever.



regards
   Hamish.




----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki