Re: Apache::Session

[Patrick Galbraith]

Strip out stuff that could be problematic. This is what we did with 
Slash. We strip out javascript or any tag that can be problematic, or be 
used even to break the layout of the page. It'll make you're life much 
easier ;) Take this from someone who coded tons of features to ward off 
trolls!

Aleksandr Guidrevitch wrote:
Hi, All

Sorry, this post might be out of scope of this particular list, but 
still... don't punch me heavily :) I just think the people here might 
have met this problem while deploying big public applications.

I use Apache::Session to identify logged in users. However, the users 
are allowed to post html (obviously with javascript) messages viewable 
by others. That could create an XSS vulnerability and allow to steal the 
sessions (cookies) from other users.

Is it possible to uniquely identify the user by some attributes ?
The only thing I consider now is IP, but what about proxies and NATs ?
User Agent string could also be stolen via javascript. That means I tend 
to make stolen session ids non-reusable.

Any thoughts ?

Sincerely,
Aleksandr Guidrevitch
--
----------------------
Patrick Galbraith
Senior Software Developer
[EMAIL PROTECTED] [EMAIL PROTECTED]
206.719.2461