|
Hi all
Can cookies be "stolen" by other parties? How safe are they? Is it ok to leave info like username and email in an unencrypted form in a cookie? Or maybe someone can point me to a link explaining cookie security. 
CHeers
"There are no stupid question's, just stupid people."
|
|
|
|
|
I would never leave any personally identifiable information in a cookie, such as a username, email, name, address, et al.
Probably the best place to start is the Platform for Privacy Preferences (P3P) Project[^].
Interesting: Microsoft Privacy and Security Fundamentals[^]. Quite useful and informative to see what your browser tells the "world," as well as a good starting point for you.
There are a ton of sites about cookies, but they are only a small part of the whole Privacy and Security issue.
-- ian
"The greatest danger to humanity is humanity without an open mind."
- Ian Mariano
http://www.ian-space.com/
|
|
|
|
|
leppie wrote:
Can cookies be "stolen" by other parties? How safe are they? Is it ok to leave info like username and email in an unencrypted form in a cookie? Or maybe someone can point me to a link explaining cookie security
I do not know the details but there are ways and means of hijacking cookies, so don't store sensitive information in them.
Paul Watson
Bluegrass
Cape Town, South Africa
Ray Cassick wrote:
Well I am not female, not gay and I am not Paul Watson
|
|
|
|
|
A cookie cannot be accessed by another site (because the client machine sends them based on url), but they can be created by another site for your use. In that way they're totally secure.
But they are sent as part of every HTTP request to the site that they're designated to, so it's possible for them to be "caught" if you're not in an SSL area of the site.
An unencrypted username and email isn't going to be much use to anyone, hence nearly every site has a "keep me logged on" checkbox that allows you to accept your own user id as a cookie.
But I wouldn't advise using cookies to send unencrypted passwords or even encrypted credit card information around.
Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand
|
|
|
|
|
Paul Riley wrote:
A cookie cannot be accessed by another site (because the client machine sends them based on url)
That isn't entirely true.
It's true in the respect that it is how it is supposed to work, but security flaws keep on popping up in browsers that allow for a malicious website to access a user's cookies for a different site
--
Help me! I'm turning into a grapefruit!
|
|
|
|
|
That's a fair comment. It's only as secure as any other information on your harddrive, possibly less so because the browser must be able to access it or cookies won't work.
However, the fact still remains that it's almost secure and information like user id and email address aren't generally the kind of thing people who write such malicious sites are looking for.
Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand
|
|
|
|
|
OK thanx all
I have a single value in my cookie at the moment (ASP.NET Authetication cookie) that is encypted, so I should not have to worry about that. I was wondering about email addys specifically, but I guess I can pull that from SQL
Cheers
"There are no stupid question's, just stupid people."
|
|
|
|
|
leppie wrote:
I was wondering about email addys specifically, but I guess I can pull that from SQL
If you have the information already on the server then use it. Cookies are more for state management (identifying the user) than for storing information about the user, especially information you already have.
Paul
I think there're pieces of me you've never seen - Tori Amos, Tear in Your Hand
|
|
|
|
|
Thanx 
"There are no stupid question's, just stupid people."
|
|
|
|
|
So does that mean we can look forward to an article on cookie encryption? 
I've always heard that there was an idea behind Win ME... I still can't figure out what that was... anyboy know??? I;ve herad the idea was that it was supposed to be n operating system but I doubt this. - Brian Delahunty
|
|
|
|
|
Megan Forbes wrote:
So does that mean we can look forward to an article on cookie encryption?
No, ASP.NET does everything automatically  , if you dont need roles.
"There are no stupid question's, just stupid people."
|
|
|
|
|
 We only get to upgrade to .Net in January. I feel so deprived... 
I've always heard that there was an idea behind Win ME... I still can't figure out what that was... anyboy know??? I;ve herad the idea was that it was supposed to be n operating system but I doubt this. - Brian Delahunty
|
|
|
|
|
I reckon I know enough of ASP.NET after 1 month crash-coursing it But having done C# the last 6-7 months has been a real help
"There are no stupid question's, just stupid people."
|
|
|
|
|
I have this code that i use to query my database to pull out customers email addresses, however i am trying to get it to pull out email accounts from a whole list of domain names ( i.e from a comma seperated values e.g domain1.com, domain2.com )
So that i can do a bulk search and get bulk results as
domain1.com fred@somehotmail.com
domain1.com fredrika@someotherhotmail.com
---------------------------here is the current code--------------------------
<%
var-domain = Request.Querystring("domain-name")
SQL="SELECT email FROM requests WHERE domain = '" & var-domain & "'"
Set connb = server.createobject("ADODB.Connection")
connb.open "some-connection"
set user = connb.execute(SQL)
Do UNTIL user.EOF
var-email=user.Fields("email")
%>
<p><b><%-var-domain %> sdasda</b></p>
<% user.MoveNext
Loop
connb.close %>
-----------------------------------------------------------------------------------
|
|
|
|
|
This should work:
<code>
dim domain, sql, conn, adors
domain = trim(replace(Request.QueryString("domain"), "'", "''"))
sql = "SELECT email FROM requests WHERE domain = '" & domain & "'"
conn = Server.CreateObject("ADODB.Connection")
adors = Server.CreateObject("ADODB.Recordset")
conn.ConnectionString = "[YourConnectionString]"
conn.Open
adors.ActiveConnection = conn
adors.Open(sql)
With Response
Do Until adors.EOF
.Write "E-Mail:" & adors("email") & " " & domain & "<br>"
.Write adors.MoveNext
Loop
End With
adors.Close
Set adors = Nothing
conn.Close
Set conn = Nothing
</code>
Nick Parker
May your glass be ever full.
May the roof over your head be always strong.
And may you be in heaven half an hour before the devil knows you’re dead. - Irish Blessing
|
|
|
|
|
Are there any standards about say when an asp page containing form submitted and I want to retrive form field values from the submitted action?
I see request.form("some form field name") ,and request.querystring("some form field name"),and even request("some form field name");Any differences?
I am not a much skilled asp programmer.So anyone please say some to me.
Thanks.
this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.
|
|
|
|
|
Here you go.
If you are parsing query string, just replace request.form with request.querystring.
sub EnumForm()
dim theKey
for each theKey in Request.Form
response.write theKey & " -- " & Request.Form(theKey) & "<BR>"
next
end sub
|
|
|
|
|
Thanks.
So what is the difference between "query sting" and "form field string"?
And what is the meaning of "request("some form field name")"?
this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.
|
|
|
|
|
If your form has method="get", or no method defined, the values will be passed in the query-string - e.g. http://www.yourdomain.com/page.asp?Field1=Value&Field2=Another%20Value. To access them, you need to use Request.QueryString. The amount of data you can accept is extremely limited, and will be visible in the browser history, so this method is not recommended for long forms.
If you have a form with method="post", the form values will be passed in the body of the request, and you will access them using Request.Form.
Code which calls Request("some form field name") allows for values to be passed in through either method. However, this will check all server collections (ServerVariables, Cookies, etc.) which is much less efficient than checking the correct collection.
|
|
|
|
|
Thanks,Richard.
The info is much understandable.
But I still has some puzzles.
you said "If your form has method="get", or no method defined".
What about no form defined?Can I use the http example you gave and retrieve field1 and field2 values using request.querysting("field")?
And you said "The amount of data you can accept is extremely limited",what is the limitation?
Thanks again.
this is my signature for forums quoted from shog*9:
I can't help but feel, somewhere deep within that withered, bitter, scheming person, there is a small child, frightened, looking a way out.
|
|
|
|
|
zhoujun wrote:
What about no form defined?
You can pass data to another page in the querystring without using a form. Just append the names and values to the URL, e.g. http://www.codeproject.com/script/comments/forums.asp?msg=321406&forumid=1640[^]. You need to make sure that the names and values are properly encoded, using the Server.UrlEncode method, otherwise some browsers will not process the request properly.
zhoujun wrote:
what is the limitation?
The limit is typically 2Kb.
|
|
|
|
|
Could someone please show me how to set up 2000 server to use the somename.yourdotcom.com. Thank you
Darroll
|
|
|
|
|
You need to create on your DNS the "A" (alias) record for "somename" on the domain "yourdotcom.com".
lazy isn't my middle name.. its my first.. people just keep calling me Mel cause that's what they put on my drivers license. - Mel Feik
|
|
|
|
|
Alias, once I looked that up on the web I got about a million hits. Thanks. Sometimes knowing the right terminology pays off ten fold.
Darroll
|
|
|
|
|
If its only the local machine such as my case, you can just edit the HOSTS file and map host.domain.com to your IP. I use this to access my PC via a dynamic DNS hostname, took months to realise it
"There are no stupid question's, just stupid people."
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
