5

I understand how ssl works, so the browser sends the username/password encrypted. But what happens next ?

Does the client receive a cookie ? Is it secure ? How does the server-browser communicate safely if the only https page is the login page ?

I think if someone get's a copy of that cookie when it's being sent, they can acces that account, no matter how encrypted is the cookie

Actually I want to understand the process from login to logout in a secure web application.

Server: Tomcat, Apache ... Platform: java, php, ...

Thank you

Horatiu Jeflea
  • 7,256
  • 6
  • 38
  • 67

2 Answers2

3

If anyone else trips onto this: I found this Wikipedia article on Session Fixation and this SO Question very useful in answering this question, than the 90+ minute podcast from GRC (noted above) that is mostly related to SSL/TLS.

Community
  • 1
  • 1
MandoMando
  • 5,215
  • 4
  • 28
  • 35
0

Episode 195 of the security now podcast deals with this topic in some depth. http://www.grc.com/securitynow.htm You can either scan the transcript (which I would recommend to do first in order to find out, wether it answers your questions) or listen to the whole episode.

jens
  • 1,763
  • 1
  • 15
  • 25
  • This is a great PodCast on SSL/TLS security. It does not, however, address http session management for non-https pages. – MandoMando Oct 24 '11 at 14:35