Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #36180

Re: Browser Back Button

From Robert Klemme <shortcutter@googlemail.com>
Newsgroups comp.lang.java.programmer
Subject Re: Browser Back Button
Date 2017-01-10 08:03 +0100
Message-ID <edjfb0Fg0mjU1@mid.individual.net> (permalink)
References <9fc9d84a-b4a7-45a6-a47a-ab7d885bf5ce@googlegroups.com> <o50l57$t2g$1@gwaiyur.mb-net.net> <o51aks$18p4$1@gioia.aioe.org>

Show all headers | View raw

On 10.01.2017 01:42, Arne Vajhøj wrote:
> On 1/9/2017 1:35 PM, Marcel Mueller wrote:
>> Destroy the session on logout and accept a login only if it comes with
>> the current, unpredictable session ID and the session is not just
>> created by the login request. This will prevent from any kind of replay
>> attack.
>
> I thought HTTPS protected against replay attacks?

Yes, on the TCP level.  And strictly it is SSL that does the protection. 
  But browser back does not do a replay of network requests.  It sends a 
previous request again.

Cheers

	robert

-- 
remember.guy do |as, often| as.you_can - without end
http://blog.rubybestpractices.com/

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Browser Back Button Davej <galt_57@hotmail.com> - 2017-01-08 15:41 -0800
  Re: Browser Back Button Arne Vajhøj <arne@vajhoej.dk> - 2017-01-08 19:30 -0500
    Re: Browser Back Button Arne Vajhøj <arne@vajhoej.dk> - 2017-01-08 20:20 -0500
      Re: Browser Back Button Davej <galt_57@hotmail.com> - 2017-01-10 15:29 -0800
        Re: Browser Back Button Arne Vajhøj <arne@vajhoej.dk> - 2017-01-10 19:49 -0500
          Re: Browser Back Button Robert Klemme <shortcutter@googlemail.com> - 2017-01-11 19:13 +0100
            Re: Browser Back Button Davej <galt_57@hotmail.com> - 2017-01-21 11:43 -0800
              Re: Browser Back Button Robert Klemme <shortcutter@googlemail.com> - 2017-01-22 13:52 +0100
                Re: Browser Back Button Davej <galt_57@hotmail.com> - 2017-01-22 08:34 -0800
  Re: Browser Back Button Marcel Mueller <news.5.maazl@spamgourmet.org> - 2017-01-09 19:35 +0100
    Re: Browser Back Button Arne Vajhøj <arne@vajhoej.dk> - 2017-01-09 19:42 -0500
      Re: Browser Back Button Robert Klemme <shortcutter@googlemail.com> - 2017-01-10 08:03 +0100
        Re: Browser Back Button lewbloch@gmail.com - 2017-01-10 11:30 -0800

csiph-web