Re: Multipart questions

From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php
Subject	Re: Multipart questions
Date	2016-12-01 20:03 +0100
Message-ID	<eabah0Fbcd6U1@mid.individual.net> (permalink)
References	<083d5e3f-1bb8-4caf-9372-2c4ced60bb2f@googlegroups.com>

Show all headers | View raw

On 12/01/2016 06:50 PM, bit-naughty@hotmail.com wrote:
> I've used sites, for example, a bank's where you login with your username and password, 
> and then it asks you "security questions" - like, your favourite colour, whatever, etc. etc.
> How is this sort of thing coded? The security questions appear without a refresh, mind you,
> ie. on the same page - so after the name+pwd authentication is done, does *client side 
> Javascript* set some sort of cookie?

The login will be done over ajax call as Cybercode mentioned, if the
username/password matches, the server will send the security question as
a response in the earlier mentioned ajax call.

The client side is untrusted, so the cookie has already been set when
you enter the login page (before you enter your username/password), the
session data on the server side will be updated if a successful login.

> If, after entering your username and password,
> the security quesions appear, and you refresh the page - what happens exactly?

Much depends on how it's designed, if badly then you will be asked for
username/password again, if done properly you will be asked for the
security question.

A side note, those security questions are a false sense of security, if
you want security you go for 2 factor authentication.

> The authentication will happen again, and *another* cookie will be set.....
> - how does the system protect against that?

You don't have to set a new session cookie, you can keep on using the
one you had in the first place, but you may change it to make it a bit
more difficult to steal the session cookie and use it to access the
system. There are a lot to read about this at OWASP, see
https://www.owasp.org/index.php/Main_Page

-- 

 //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Multipart questions bit-naughty@hotmail.com - 2016-12-01 09:50 -0800
  Re: Multipart questions Cybercode <lambda@dr.com> - 2016-12-01 18:36 +0000
    Re: Multipart questions Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-02 01:06 +0100
      Re: Multipart questions Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-01 19:48 -0500
        Re: Multipart questions Arno Welzel <usenet@arnowelzel.de> - 2016-12-03 12:55 +0100
          Re: Multipart questions Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-03 10:12 -0500
            Re: Multipart questions Arno Welzel <usenet@arnowelzel.de> - 2016-12-04 23:24 +0100
              Re: Multipart questions Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-05 00:17 +0100
              Re: Multipart questions Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-04 19:17 -0500
                Re: Multipart questions "R.Wieser" <address@not.available> - 2016-12-05 10:08 +0100
                Re: Multipart questions Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-05 08:27 -0500
                Re: Multipart questions "R.Wieser" <address@not.available> - 2016-12-05 16:33 +0100
                Re: Multipart questions Arno Welzel <usenet@arnowelzel.de> - 2016-12-05 19:06 +0100
  Re: Multipart questions "J.O. Aho" <user@example.net> - 2016-12-01 20:03 +0100

csiph-web