PHP Security Basics Chapter 7 Verification and Authorization password sniffing

7.2. Password sniffing

Although attackers do not use network communication between your users and applications for access control, they must be aware that data exposure is becoming more and more important, especially for authentication information.

 

Using SSL can effectively prevent HTTP requests and responses from being exposed. Requests to any resources using the HTTPS scheme can prevent password sniffing. The best way is to always use SSL to send authentication information, and you may also want to use SSL to send all requests containing session IDs to prevent session hijacking.

To prevent the user authentication information from being exposed, use the HTTPS scheme in the URL of the form's action attribute as follows:

Code:

 

<Form action = "https://example.org/login.php" method = "Post">

<P> Username: <input type = "text" name = "username"/> </P>

<P> password: <input type = "password" name = "password"/> </P>

<P> <input type = "Submit"/> </P>

</Form>

We highly recommend that you use the POST method in the verification form, because no matter whether you use SSL or not, the verification information is less exposed than the get method.

Although this is only to protect the user's authentication information from being exposed, you should also use SSL for HTML forms at the same time. This is not for technical reasons, but when users see that the form is protected by SSL, they will feel more comfortable when entering verification information (see figure 7-1 ).

 

Figure 7-1. Most browsers display a lock icon when the current resource is protected by SSL.