InterviewSolution
Saved Bookmarks
InterviewSolution
| 1. |
What Happens If The Obssocookie Is Tampered? |
|
Answer» When access system GENERATES ObSSOCookie, MD-5 HASH is taken from session token. So when the user is authenticated again using the cookie, the MD5 hash is compared with ORIGINAL cookie contents. MD-5 hash is a one-way hash, hence it cant be unencrypted. Access server compares the cookie contents with hash. If both are not same, then cookie is tampered in the interim. This cookie does not contain USERNAME and PASSWORD. When access system generates ObSSOCookie, MD-5 hash is taken from session token. So when the user is authenticated again using the cookie, the MD5 hash is compared with original cookie contents. MD-5 hash is a one-way hash, hence it cant be unencrypted. Access server compares the cookie contents with hash. If both are not same, then cookie is tampered in the interim. This cookie does not contain username and password. |
|