javascript - Prevent user created pages from stealing login cookies -


i have webpage, let's page called: http://www.mypage.this/

in page users can create own html pages , access them through www . mypage . / (creator's_username) / (project_name) . instance, if username "usr" , project called "project" link http://www.mypage.this/usr/project .

but there's security problem...

i store people's login tokens cookies. , if user's script has function reads cookie , sends else?

they can access else's account. token has saved cookie, because need verify user in multiple pages. should prevent user created scripts reading tokens, yet still allow pages read token?

thank in advance

*the tokens of course regenerated every once in while

to clear misunderstanding, not storing passwords in user's side. storing login cookie - randomly generated string, re-generated on every login. , store on user's side.

if have verify users in multiple pages, should store login information in session, not in cookies. way stays on server, , can access it.

cookies made can store information when user disconnect, leave browser or else.

storing login information in cookies bad idea, it's not secure.


-

Comments

Post a Comment

Popular posts from this blog

amazon web services - S3 Pre-signed POST validate file type? -

i know it's possible put limit on file size content-length-range header. possible validate file type? https://docs.aws.amazon.com/amazons3/latest/dev/httppostforms.html#policyconditions i see there content-type header, if set say, audio/mp3 allow mp3 files , return error if file not mp3? i found previous question answers mention validating file size: s3 direct upload restricting file size , type you can specify content-type @ post request. you can specify @ signature, post must done content-type: { "expiration": "2007-12-01t12:00:00.000z", "conditions": [ {"acl": "public-read" }, {"bucket": "johnsmith" }, {"content-type: "audio/mp3"} ] } creating html form (using aws signature version 4) edit: @ previous question found, checking content-type.
Read more

c# - Check Keyboard Input Winforms -

i wondering if instead of doing this protected override void onkeydown(keyeventargs e) { if (e.keycode == keys.a) console.writeline("the key down."); } i set bool method , this: if(keydown(keys.a)) // whatever here i've been sitting here ages trying figure out how it. can't wrap head around it. in case wondering, plan call bool inside different method, check input. since want perform action after pressing key, using keydown event enough. but in cases suppose want check if specific key down in middle of process, can use getkeystate method way: [dllimport("user32.dll", charset = charset.auto, exactspelling = true)] public static extern short getkeystate(int keycode); public const int key_pressed = 0x8000; public static bool iskeydown(keys key) { return convert.toboolean(getkeystate((int)key) & key_pressed); } you should know, each time check key state using example iskeydown(keys.a) method returns true if ke...
Read more