Warning: Can't synchronize with repository "(default)" (/home/git/ome.git does not appear to be a Git repository.). Look in the Trac log for more information.

Changes between Initial Version and Version 5 of Ticket #3202


Ignore:
Timestamp:
05/02/11 16:26:19 (13 years ago)
Author:
saloynton
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #3202

    • Property Cc bwzloranger saloynton added
    • Property Component changed from General to Documentation
    • Property Remaining Time changed from to 0.2
    • Property Milestone changed from Unscheduled to OMERO-Beta4.3
    • Property Owner set to saloynton
    • Property Sprint changed from to 2011-05-05 (11)
    • Property Type changed from story to task

  • Ticket #3202 – Description

    initial v5  
    11See #3201 
     2 
     3Confirm the valid scenario:   
     4 
     5Otherwise an attacker could: 
     6 
     7sniff a session uuid from the wire (which will eventually timeout) 
     8login with the session uuid 
     9call changePassword 
     10start creating new sessions with the new password 
     11I realize that in the web scenario N-1 of the workers will have been authenticated with a session uuid, so if you receive a SecurityViolation you will need to re-authenticate, or create a temporary SSL-based omero.client with the real password. 

1.3.13-PRO © 2008-2011 Agilo Software all rights reserved (this page was served in: 0.16268 sec.)

© 2000-2014 University of Dundee & Open Microscopy Environment. Creative Commons Attribution 3.0 Unported License
OME source code is available under the GNU General public license or through commercial license from Glencoe Software

We're Hiring!