CiviCRM Community Forums (archive)

With the current project I working on we are running into problems with our internal security team, who are vetoing sending sessions ID's that link to information about a donation we are trying to receive without HTTPS encryption. So my question/idea is this;

Could you clarify what is the risk to be avoided?
To be able to steal the session id, you need to be able to read the http traffic, so you can as well read the first name and address and whatever else is transmitted in the contribution page

with the session id for an anonymous session, I don't think you will be able to access to any information beside the information transmitted in the contribution form, that you would have been able to steal anyway if you are able to get access to the session id.

So I'm not sure I understand what we are trying to protect here (obviously, using https would be better anyway)

would it be possible for civi crm to self-encrypt and decrypt information that it puts into the session?

Thus making the ID useless without the corresponding key value to decrypt. Or alternatively if there is a performance hit with encrypting that much data, an optional extra session (who’s ID is sent without encryption) that holds an encrypted ID to the session with the persons information (a roundabout method I know).

Again, what are we trying to protect here?

Presumably, the idea is that civi has the key, so if you have been able to steal my session id, you can still convince civi you are me and let it decrypt whatever is in the session.

Moreover, very little "useful" stuff is stored in the session anyway, the only real benefit is that it would allow to pretend to be me, and encrypting the few stuff stored in the session isn't going to be impacted

I understand the general security policy, but not sure it's relevant in this case. Am I missing something?

Would also be a lot easier just to install an SSL cert--they're not expensive.