| |||||||||||||
Should web developers say no to cookie-based authentication?Should web developers say no to cookie-based authentication?Posted Mar 25, 2010 2:27 UTC (Thu) by ras (subscriber, #33059)Parent article: Should web developers say no to cookie-based authentication?
A lot of words. If I understand them correctly, they reduce to two points:
1. RFC 2617 auth can be immune to replay attacks, because they include a nonce count. This difficult to do with cookies.
2. By making it possible for app coders to use a standard auth library, we reduce the number of bugs.
Is that it?
(Log in to post comments)
Should web developers say no to cookie-based authentication? Posted Mar 25, 2010 16:58 UTC (Thu) by epa (subscriber, #39769) [Link]
I understood
3. In practice, a lot of cookie-based auth systems are badly done, whereas the digest authentication in popular browsers and popular web servers follows a sensible design (the two RFCs mentioned) and is well implemented. However, it doesn't have a shiny user interface that site designers want.
|
|||||||||||||