AOH :: HP Unsorted F :: BU-1879.HTM

Form-based HTTP Authentication Proof of Concept



Form-based HTTP Authentication Proof of Concept
Form-based HTTP Authentication Proof of Concept



Hello,

As a follow up to my paper advocating HTTP authentication in place of
cookies [1], I've built a simple sample application which demonstrates
how a combination of XMLHttpRequest and response code tricks can be 
used to achieve form-based login, logout, and authenticated password
changes in the four most popular browsers:
http://www.vsecurity.com/download/tools/fbha-poc_0.1.zip 

Note that this is achieved without using any checks to determine what 
browser is being used.

While this is promising, I still think we should have an HTTP-based 
log out mechanism.  In addition, the proposed W3C change to 
XMLHttpRequest authentication behavior will make this code much 
simpler.

cheers,
tim


1. http://www.vsecurity.com/download/papers/WeaningTheWebOffOfSessionCookies.pdf 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.