Re: Cookie Persistance

I agree that encrypting cookies consumes processing time for the ADCs and
is a performance impact.
At the same time, it prevents from smart hackers who has the capability to
use that little information to exploit the servers.

Thanks,
-Ravi.


> Quoting Kenneth Salchow <[email protected]>:
>
>> Content-Type: text/plain;
>> 	charset="iso-8859-1"
>> Content-Transfer-Encoding: quoted-printable
>>
>> BTW--you might also want to see if you can apply encryption to those
>> cookies
>> at the ADC--whether generated by the ADC or the server.  Especially if
>> you're using something like JSessionID from the server.  It's a fairly
>> simple thing that can dramatically increase your overall security
>> posture.
>>
>
> I have to jump in here... Encrypted cookies are (Or should be) a
> complete waste of time.
>
> If you follow the guidelines of basic best practice and security, any
> cookie content SHOULD be an opaque key. With no actual data in it. Any
> cookies you set in an HTTPS session should also be set as a secure
> cookie so it is never presented across an http session (To prevent
> cookie stealing).
>
> Good security practices start with a healthy dose of paranoia. If
> there's no data in a cookie there's only the 'key' aspect of it to
> take care of (i.e. it doesn't matter if someone steals an opaque
> session id a week later. The session has expired therefore the session
> data will no longer be on the server. The data is only vulnerable
> until it expires. But a session cookie that includes data is
> vulnerable forever.
>
>
>
> regards
>    Hamish.
>
>
>
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
>
>
>



_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki