Prevent Session Hijacking in Web Application

July 25, 2007

Trying to prevent session hijacking is a pain in the butt, especially since replay attacks by-pass pretty much any mechanism you can put into place (aside from using HTTPS). I’ve read suggestions about using things liked hashed (with a salt) User-Agent strings that get appended to the url and checked, in addition to the actual session id (coming from a cookie). Anyone have a particular idea that works well, or have any suggestions on things that really should be avoided? See  more at link


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: