Alaric B Snell wrote:
> I came across a page that reminded me of another downside to HTTP auth -
> there's no way for the server to cancel the session if it believes the
> session might be compromised
The HTTP RFC actually calls this out in the security considerations
section. RFC 2616, section 15.6. The words there are not encouraging.
/r$
--
Rich Salz, Chief Security Architect
DataPower Technology http://www.datapower.com
XS40 XML Security Gateway http://www.datapower.com/products/xs40.html
XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html
