Re: Browser refresh sends username/password after log out -- URGENT

If I understand this correctly, the application is allowing cacheing of the credentials. One way to discourage this, from the application's perspective, is to include a script function such as <FORM AUTOCOMPLETE="off"> within the splash page script, as well as the appropriate Cache-Control directive (e.g. "Cache-Control: no-cache"). Just the fact that this cacheing of credentials is possible within a banking application makes the app a potential target for attackers who may see it as a treasure trove of vulnerabilities.

-I

K Kohli wrote:

> I am into remote application testing for a critical

--

-· · ···- · ·-· ·--· · - ·- -··· ··- ·-· -· ·· -· --· -·· --- --·
"If you sit quietly at the edge of a river, eventually
you will see the bodies of your enemies float by"
-A maxim of patience, author unknown

Imre Kertesz
480.363.1492
PGP ID: 0x1C1E5054