From: Michael Robinson <robinson@netrinsics.com>
To: pgsql-interfaces@postgreSQL.org
To: ser@nsu.ru
Subject: Re: [INTERFACES] WEB-interface
Date: Thu, 15 Apr 1999 13:36:25 +0800 (CST)
Message-ID: <199904150536.NAA00398@netrinsics.com> (raw)
In-Reply-To: <003101be86fe$963a9770$59d17cc1@cnit.nsu.ru>
"Sergei Chernev" <ser@nsu.ru> writes:
>But if I want to create subform, I have to know username/password again.
>Now, I'm solving this problem transmitting <input type="hidden"> back
>to client - but this method is wrong.
Make an MD5 checksum of the username, password, and current time. Send the
MD5 checksum in a hidden field (or use a cookie). Keep a server-side cache
of the currently valid checksums (expire the old ones periodically), and
check the incoming checksum against the cache for each request.
-Michael Robinson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: robinson@netrinsics.com, ser@nsu.ru
Subject: Re: [INTERFACES] WEB-interface
In-Reply-To: <199904150536.NAA00398@netrinsics.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox