Mailing-List: contact clerezza-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: clerezza-dev@incubator.apache.org
Message-ID: <461844913.41431264526074621.JavaMail.jira@brutus.apache.org>
Date: Tue, 26 Jan 2010 17:14:34 +0000 (UTC)
From: =?utf-8?Q?Reto_Bachmann-Gm=C3=BCr_=28JIRA=29?= <jira@apache.org>
To: clerezza-dev@incubator.apache.org
Subject: [jira] Commented: (CLEREZZA-44) Change cookie-based authentication
In-Reply-To: <1401583734.1261131678201.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


    [ https://issues.apache.org/jira/browse/CLEREZZA-44?page=3Dcom.atlassia=
n.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D128=
05101#action_12805101 ]=20

Reto Bachmann-Gm=C3=BCr commented on CLEREZZA-44:
--------------------------------------------

It seems like this describes two separate issues, I agree with the first on=
e, that cookie should by deffault expire (even though I'd like to see a che=
ck box "keep me logged in").

As for the second issue: Cookie login isn't offering more security than bas=
ic authentication, even if we would scramble the password this wouldn't  in=
crease security as the scrambled password would be enough for the attacker =
to log in. It could even be a danger as it makes the user think that his pa=
ssword is somehow safe while it fact it isn't. What might be possible is to=
 encode the password together with IP and/or Date, this could produce an au=
thentication token only valid for request (apparently) coming from a certai=
n IP and only valid within a certain period, the latter would compromise th=
e "keep me loged in feature".

> Change cookie-based authentication
> ----------------------------------
>
>                 Key: CLEREZZA-44
>                 URL: https://issues.apache.org/jira/browse/CLEREZZA-44
>             Project: Clerezza
>          Issue Type: New Feature
>            Reporter: Marco Zaugg
>
> Authentication cookie should expire after browser session ends. Furthermo=
re, encode login credentials instead of showing them as plain text.

--=20
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.