By Richard Li
</authorblurb>The security system was designed for security. Thus, decisions +Security Notes
The security system was designed for security. Thus, decisions requiring trade-offs between ease-of-use and security tend to result in a system that may not be as easy to use but is more secure.
If a user switches to HTTPS after logging into the system via -HTTP, the user must obtain a secure token. To insure security, the +HTTP, the user must obtain a secure token. To ensure security, the only way to obtain a secure token in the security system is to authenticate yourself via password over an HTTPS connection. Thus, users may need to log on @@ -65,8 +72,8 @@
The set of string match expressions in the procedure above
should be extended appropriately for other registration pages. This
procedure does not use ad_parameter
or regular expressions for
-performance reasons, as it is called by the request processor.
($Id: security-notes.xml,v 1.7 2014/10/27 -16:39:32 victorg Exp $)
+performance reasons, as it is called by the request processor.