How can I prevent spoofing CA SiteMinder?

According to Wikipedia, “a spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage.” All SSO solutions are prone to facing situations where a valid session cookie is used to attempt to open another HTTPS SSL session. The key to avoiding this situation is to prevent the cookie from being accessed to begin with, and there are several ways to do this:

  1. Use the Secure Cookies option on the web agent to prevent the cookie from being sent to non-SSL enabled web servers.
  2. Use transient cookies instead of persistent cookies.
  3. Always enable SSL between the browser and the web agent.
  4. Enable the IP Checking feature to ensure that the cookie is validated against the user’s IP address.
  5. Shorten the length o the Max Session & Idle Session timeout values for your SiteMinder realms.
  6. Roll over agent keys at shorter intervals.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: