Re: Neomail security

This only happens on the very first page viewed after login -- this is 
because your browser resends the login and password.  If you click to view a 
message and then log out, or perform any other action, then when you logout 
your session is deleted.  As with all web based authentication mechanisms, 
it's always best to close the browser to be safe after a logout. There will 
always be a page in the browser history that was generated by sending your 
login and pass and if a user is able to go back to it they will get in.

To confirm this is the case note that the "bug" you mention results in you 
being assigned a new session id, which is viewable in the URL of the pages 
returned.

----- Original Message ----- 
From: <[email protected]>
To: <[email protected]>
Sent: Monday, November 29, 2004 11:18 AM
Subject: [Neomail-users] Neomail security


In neomail th logout is not a real logout.
Try to login in neomail, and then make logout. You are sent to the login 
screen, but if you puch back button on explorer you'll get the message of 
page expired, then you update the page and you are inside neomail again, but 
you have not write yout login pass again!!!.
So, if anybody logout from neomail and leave the computer on (with the 
explorer open), another person could enter in his neomail account using the 
pages stored in history of browser.

I think neomail would have to accept the login from a refreshed expired 
page. The only way I've found is add a "time mark" in the login form and 
compare this time mark with a time mark calculated in the moment of login, 
if the difference is a few seconds the login is processed, but if the 
difference is too high the login is not processed. But there is a problem, 
if the user delays too time writing his login data the login is rejected 
too.

Regards 



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/