Need Help

[prabhash singh]

Hi All
I am working on a financial product.product is completed. the technology used are Struts, AJAX etc.now i have to provide seesion level security. how can i do. please help.

Thanks,
Prabhash kumar

[Rahul Bhattacharjee]

What is it session level security ?

[prabhash singh]

Hi Rahul,
Session level security means , secure the session object. Becuase using Ajax with a web Application, it's easy for Hacker to hack the Session obejct.
Any advice to how to secure the session object at application level, not at Network level. I have already encrypted the password, any way to secure the session object.

Thanks in advance,

Regards,
Prabhash kumar (SCJP 1.4, SCWCD-preparing)

[Ulf Dittmer]

Becuase using Ajax with a web Application, it's easy for Hacker to hack the Session obejct.

AJAX uses plain old HTTP, so it's as easy or hard to secure as all other web traffic. Hacking the session would at the least involve duplicating the session ID, which should be a cryptographic hash of some kind. That mechanism is used by just about all web servers, and generally considered to be secure enough. So can you explain to us why you think that with AJAX it is easy to hack a session?
[ November 08, 2006: Message edited by: Ulf Dittmer ]

[Rahul Bhattacharjee]

Please correct me if I am wrong.The HTTPSession objects always reside on the server and the session ID is the things that is transfered to the client and server.Back and forth.So in this case your session object is safe and I do not think that this is dangerous.