PHP Security Basics Chapter 7 Verification and Authorization password sniffing

Source: Internet
Author: User

7.2. Password sniffing

Although attackers do not use network communication between your users and applications for access control, they must be aware that data exposure is becoming more and more important, especially for authentication information.

 

Using SSL can effectively prevent HTTP requests and responses from being exposed. Requests to any resources using the HTTPS scheme can prevent password sniffing. The best way is to always use SSL to send authentication information, and you may also want to use SSL to send all requests containing session IDs to prevent session hijacking.

To prevent the user authentication information from being exposed, use the HTTPS scheme in the URL of the form's action attribute as follows:

Code:

 

<Form action = "https://example.org/login.php" method = "Post">

<P> Username: <input type = "text" name = "username"/> </P>

<P> password: <input type = "password" name = "password"/> </P>

<P> <input type = "Submit"/> </P>

</Form>

We highly recommend that you use the POST method in the verification form, because no matter whether you use SSL or not, the verification information is less exposed than the get method.

Although this is only to protect the user's authentication information from being exposed, you should also use SSL for HTML forms at the same time. This is not for technical reasons, but when users see that the form is protected by SSL, they will feel more comfortable when entering verification information (see figure 7-1 ).

 

Figure 7-1. Most browsers display a lock icon when the current resource is protected by SSL.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.