Verder naar navigatie Doorgaan naar hoofdinhoud Ga naar de voettekst

Whitepaper – Weaning the Web off of Session Cookies: Making Digest Authentication Viable

26 januari 2010

door Jennifer Fernick

by Timothy D. Morgan

In this paper, we compare the security weaknesses and usability limitations of both cookie-­based session management and HTTP digest authentication; demonstrating how digest authentication is clearly the more secure system in practice. We propose several small changes in browser behavior and HTTP standards that will make HTTP authentication schemes, such as digest authentication, a viable option in future application development.

This paper can be downloaded below.


Editor’s note: This work was originally published by VSR on January 26 2010 at https://www.vsecurity.com/download/publications/WeaningTheWebOffOfSessionCookies.pdf. VSR is now a part of NCC Group, so we have migrated this content to research.nccgroup.com. 

Jennifer Fernick

Jennifer Fernick

Jennifer Fernick is the Global Head of Research at NCC Group. She can be found on Twitter at @enjenneer.