Sessionlock

摘要: Typical web sessions can be hijacked easily by a network eavesdropper in attacks that have come to designated "sidejacking." The rise of ubiquitous wireless networks, often unprotected at the transport layer, has significantly aggravated this problem. While SSL protect against eavesdropping, its usability disadvantages make it unsuitable when data is not considered highly confidential. Most web-based email services, for example, use only on their login page and are thus vulnerable sidejacking.We propose SessionLock, simple approach securing eavesdropping without extending SSL. SessionLock implemented developers using JavaScript server-side logic. Its performance impact negligible, all major browsers supported. Interestingly, particularly easy implement single-page AJAX applications, e.g. Gmail or Yahoo mail, with approximately 200 lines 60 verification code.