Wednesday, January 27, 2010

Weaning the Web off of Session Cookies

Making Digest Authentication Viable

In this paper, we compare the security weaknesses and usability limitations of both cookiebased session management and HTTP digest authentication; demonstrating how digest authentication is clearly the more secure system in practice.We propose several small changes in browser behavior and HTTP standards that will make HTTP authentication schemes,such as digest authentication, a viable option in future application development.

Download PDF

No comments: