[Linux-Biella] Work è vivo, viva work :-)

[Andrea Musuruane]

2008/9/5 Manfredo Enrico - Quadra Studio Web <manfredo a quadrastudio.it>:
>> Io pero' non farei viaggiare le credenziali in chiaro in fase di login.
>>
> Cosa intendi?

Intende che usando il protocollo HTTP e con l'attuale implementazione
username e password sono non in chiaro e posso essere tranquillamente
intercettate.

http://work.bilug.it/index.php

POST /index.php HTTP/1.1
Host: work.bilug.it
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.9.0.1)
Gecko/2008070208 Firefox/3.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://work.bilug.it/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 27
*username=test&password=test*
HTTP/1.x 200 OK
Date: Fri, 05 Sep 2008 10:19:52 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29 PHP/4.4.4
X-Powered-By: PHP/4.4.4
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Fri, 05 Sep 2008 10:19:52 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Content-Type: text/html
Transfer-Encoding: chunked
Proxy-Connection: Keep-Alive
Connection: Keep-Alive

Ciao,

Andrea.
-------------- parte successiva --------------
Un allegato HTML è stato rimosso...
URL: http://ml.bilug.linux.it/pipermail/linux/attachments/20080905/b29f7e1c/attachment.html