Recent Features
| |||||||||||||
Should web developers say no to cookie-based authentication?Should web developers say no to cookie-based authentication?Posted Mar 25, 2010 20:31 UTC (Thu) by Cyberax (✭ supporter ✭, #52523)Parent article: Should web developers say no to cookie-based authentication?
WTF?
Cookies are just a way to store session-id. I'd understand if the author wanted to define a special session-tracking API (in essence, adding state to HTTP) with protection against cross-site scripting, etc.
But this crap? No way.
How can I use OpenID with digest authentication? How do I use GSSAPI (Kerberos or SMKP)?
Use single responsibility principle and split the spec into session-tracking stuff and use digest authentication as one way to provide session identifiers.
(Log in to post comments)
Should web developers say no to cookie-based authentication? Posted Mar 26, 2010 21:19 UTC (Fri) by jo42 (subscriber, #59640) [Link]
Are you looking for the kerberos or OpenID authentification module of Apache and instructions like these: http://www.google.com/search?ie=UTF8&q=firefox%20kerb...
Should web developers say no to cookie-based authentication? Posted Mar 26, 2010 21:20 UTC (Fri) by Cyberax (✭ supporter ✭, #52523) [Link]
No. I'm talking about impossibility of using digest authentication and Kerberos/OpenID.
|
|||||||||||||