PHP Security-password sniffing

Password sniffing although attackers do not use network communication between your users and applications for access control, they must be aware that data exposure becomes more and more important, especially for authentication information. Use SSL...

Password sniffing

Although attackers do not use network communication between your users and applications for access control, they must be aware that data exposure is becoming more and more important, especially for authentication information.

Using SSL can effectively prevent HTTP requests and responses from being exposed. Requests to any resources using the https scheme can prevent password sniffing. The best way is to always use SSL to send authentication information, and you may also want to use SSL to send all requests containing session IDs to prevent session hijacking.

To prevent the user authentication information from being exposed, use the https scheme in the URL of the form's action attribute as follows:

CODE:

We highly recommend that you use the POST method in the verification form, because no matter whether you use SSL or not, the verification information is less exposed than the GET method.

Although this is only to protect the user's authentication information from being exposed, you should also use SSL for HTML forms at the same time. This is not for technical reasons, but when users see that the form is protected by SSL, they will feel more comfortable when entering verification information (see-1 ).

Figure 7-1. most browsers display a lock icon when the current resource is protected by SSL.

The above is the content of the PHP Security-password sniffing. For more information, see The PHP Chinese website (www.php1.cn )!