TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
IRC Channel
IRC Speech Bubble Join the friendly bunch on IRC...
(#TalkPHP on Freenode)

...Also available via a web interface.

See this thread for information on the TalkPHP Free Hugs Initiative™. Subject to availability.
Associates
Associates
CSS Tutorials
Reply
 
LinkBack Thread Tools Search this Thread Display Modes
Old 07-26-2008, 10:23 PM   #1 (permalink)
The Visitor
Newcomer 
 
Join Date: Jul 2008
Posts: 1
Thanks: 0
johndoe123 is on a distinguished road
Default flash uploader session id security question

i have added a flash/javascript uploader to my joomla site.... the problem with flash is that it does not send the cookies..

look there
Sharing sessions between html and flash - Het bijstere spoor

this article proposes 4 solutions.... i have implemented the 3rd one... getting the session id by javascript... and i am sending the session id as POST with my flash uploader.... is it secure to do so??

for more details,this is how the uploader works
- i construct my uploader with javascript specifying a property url(which is the url of the upload script(upload.php)...
- the javascript construct the flash uploader...
- i upload a file... the javascript calls a function upload in the flash uploader
- the flash uploader uploads the file and execute the upload.php script...(without sending the cookies)...

i was planning to write a function in javascript

function getCookie(){
return document.cookie;
}

before my flash uploader uploads something it calls this js function to the the cookies and send these cookies as POST...

is it really secured to do so?? if not what's the alternative...?
johndoe123 is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 07:32 AM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0
Inactive Reminders By Icora Web Design