Web Development

28-Oct-02 19:03

Hi all

Can cookies be "stolen" by other parties? How safe are they? Is it ok to leave info like username and email in an unencrypted form in a cookie? Or maybe someone can point me to a link explaining cookie security. Smile | :)

CHeers

"There are no stupid question's, just stupid people."

ian mariano28-Oct-02 19:27

ian mariano

28-Oct-02 19:27

I would never leave any personally identifiable information in a cookie, such as a username, email, name, address, et al.

Probably the best place to start is the Platform for Privacy Preferences (P3P) Project[^].

Interesting: Microsoft Privacy and Security Fundamentals[^]. Quite useful and informative to see what your browser tells the "world," as well as a good starting point for you.

There are a ton of sites about cookies, but they are only a small part of the whole Privacy and Security issue.

-- ian

"The greatest danger to humanity is humanity without an open mind."
- Ian Mariano

http://www.ian-space.com/

Paul Watson28-Oct-02 20:13

Paul Watson

28-Oct-02 20:13

leppie wrote:
Can cookies be "stolen" by other parties? How safe are they? Is it ok to leave info like username and email in an unencrypted form in a cookie? Or maybe someone can point me to a link explaining cookie security

I do not know the details but there are ways and means of hijacking cookies, so don't store sensitive information in them.

Paul Watson
Bluegrass
Cape Town, South Africa

Ray Cassick wrote:
Well I am not female, not gay and I am not Paul Watson

Paul Riley28-Oct-02 23:58

Paul Riley

28-Oct-02 23:58

A cookie cannot be accessed by another site (because the client machine sends them based on url), but they can be created by another site for your use. In that way they're totally secure.

But they are sent as part of every HTTP request to the site that they're designated to, so it's possible for them to be "caught" if you're not in an SSL area of the site.

An unencrypted username and email isn't going to be much use to anyone, hence nearly every site has a "keep me logged on" checkbox that allows you to accept your own user id as a cookie.

But I wouldn't advise using cookies to send unencrypted passwords or even encrypted credit card information around.

Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand

benjymous29-Oct-02 0:14

benjymous

29-Oct-02 0:14

Paul Riley wrote:
A cookie cannot be accessed by another site (because the client machine sends them based on url)

That isn't entirely true.

It's true in the respect that it is how it is supposed to work, but security flaws keep on popping up in browsers that allow for a malicious website to access a user's cookies for a different site

--
Help me! I'm turning into a grapefruit!

Paul Riley29-Oct-02 0:22

Paul Riley

29-Oct-02 0:22

That's a fair comment. It's only as secure as any other information on your harddrive, possibly less so because the browser must be able to access it or cookies won't work.

However, the fact still remains that it's almost secure and information like user id and email address aren't generally the kind of thing people who write such malicious sites are looking for.

Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand

leppie29-Oct-02 0:20

29-Oct-02 0:20

OK thanx all Smile | :)

I have a single value in my cookie at the moment (ASP.NET Authetication cookie) that is encypted, so I should not have to worry about that. I was wondering about email addys specifically, but I guess I can pull that from SQL Smile | :)

Cheers

"There are no stupid question's, just stupid people."

Paul Riley29-Oct-02 0:25

Paul Riley

29-Oct-02 0:25

leppie wrote:
I was wondering about email addys specifically, but I guess I can pull that from SQL

If you have the information already on the server then use it. Cookies are more for state management (identifying the user) than for storing information about the user, especially information you already have.

Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand

leppie29-Oct-02 2:15

29-Oct-02 2:15

Thanx

"There are no stupid question's, just stupid people."

Megan Forbes29-Oct-02 2:39

Megan Forbes

29-Oct-02 2:39

So does that mean we can look forward to an article on cookie encryption? Big Grin | :-D

I've always heard that there was an idea behind Win ME... I still can't figure out what that was... anyboy know??? I;ve herad the idea was that it was supposed to be n operating system but I doubt this. - Brian Delahunty

leppie29-Oct-02 6:11

29-Oct-02 6:11

Megan Forbes wrote:
So does that mean we can look forward to an article on cookie encryption?

No, ASP.NET does everything automatically Laugh | :laugh:

, if you dont need roles.

"There are no stupid question's, just stupid people."

Megan Forbes29-Oct-02 6:16

Megan Forbes

29-Oct-02 6:16

We only get to upgrade to .Net in January. I feel so deprived... Poke tongue | ;-P

leppie29-Oct-02 6:27

Retrive form field values?

29-Oct-02 6:27

I reckon I know enough of ASP.NET after 1 month crash-coursing it Smile | :)

But having done C# the last 6-7 months has been a real help Smile | :)

"There are no stupid question's, just stupid people."

multiple query

Tuvok28-Oct-02 1:11

Tuvok

28-Oct-02 1:11

I have this code that i use to query my database to pull out customers email addresses, however i am trying to get it to pull out email accounts from a whole list of domain names ( i.e from a comma seperated values e.g domain1.com, domain2.com )

So that i can do a bulk search and get bulk results as

domain1.com fred@somehotmail.com
domain1.com fredrika@someotherhotmail.com Smile | :)

---------------------------here is the current code--------------------------

<%
var-domain = Request.Querystring("domain-name")

SQL="SELECT email FROM requests WHERE domain = '" & var-domain & "'"
Set connb = server.createobject("ADODB.Connection")
connb.open "some-connection"
set user = connb.execute(SQL)

Do UNTIL user.EOF
var-email=user.Fields("email")

%>

<p><b><%-var-domain %> sdasda</b></p>

<% user.MoveNext
Loop
connb.close %>
-----------------------------------------------------------------------------------

Re: multiple query

Nick Parker28-Oct-02 2:41

Nick Parker

28-Oct-02 2:41

This should work:

<code>
dim domain, sql, conn, adors
domain = trim(replace(Request.QueryString("domain"), "'", "''"))
sql = "SELECT email FROM requests WHERE domain = '" & domain & "'"
conn  = Server.CreateObject("ADODB.Connection")
adors = Server.CreateObject("ADODB.Recordset")
conn.ConnectionString = "[YourConnectionString]"
conn.Open
adors.ActiveConnection = conn
adors.Open(sql)
With Response
Do Until adors.EOF
      .Write "E-Mail:" & adors("email") & " " & domain & "<br>"
      .Write adors.MoveNext
Loop
End With
adors.Close
Set adors = Nothing
conn.Close
Set conn = Nothing

</code>

Nick Parker

May your glass be ever full.
May the roof over your head be always strong.
And may you be in heaven half an hour before the devil knows you’re dead. - Irish Blessing

zhoujun27-Oct-02 14:42

zhoujun

27-Oct-02 14:42

Are there any standards about say when an asp page containing form submitted and I want to retrive form field values from the submitted action?

I see request.form("some form field name") ,and request.querystring("some form field name"),and even request("some form field name");Any differences?

I am not a much skilled asp programmer.So anyone please say some to me.

Thanks.

this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.

Paul Farry27-Oct-02 20:44

Paul Farry

27-Oct-02 20:44

Here you go.

If you are parsing query string, just replace request.form with request.querystring.

sub EnumForm()
	dim theKey
	for each theKey in Request.Form 
		response.write theKey & " -- " & Request.Form(theKey) & "<BR>"
	next
end sub

zhoujun27-Oct-02 22:03

zhoujun

27-Oct-02 22:03

Thanks.
So what is the difference between "query sting" and "form field string"?
And what is the meaning of "request("some form field name")"?

this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.

Richard Deeming28-Oct-02 1:39

Richard Deeming

28-Oct-02 1:39

If your form has method="get", or no method defined, the values will be passed in the query-string - e.g. http://www.yourdomain.com/page.asp?Field1=Value&Field2=Another%20Value. To access them, you need to use Request.QueryString. The amount of data you can accept is extremely limited, and will be visible in the browser history, so this method is not recommended for long forms.

If you have a form with method="post", the form values will be passed in the body of the request, and you will access them using Request.Form.

Code which calls Request("some form field name") allows for values to be passed in through either method. However, this will check all server collections (ServerVariables, Cookies, etc.) which is much less efficient than checking the correct collection.

zhoujun28-Oct-02 13:31

zhoujun

28-Oct-02 13:31

Thanks,Richard.
The info is much understandable.

But I still has some puzzles.
you said "If your form has method="get", or no method defined".
What about no form defined?Can I use the http example you gave and retrieve field1 and field2 values using request.querysting("field")?

And you said "The amount of data you can accept is extremely limited",what is the limitation?

Thanks again.

this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.