Take the 2-minute tour ×  I am implementing a web api with which
I plan to authorize access by accepting a username and password
and system name and returning a sessionid which can be used on
subsequent calls to authorize the caller.  The api is only
available though SSL 3.0 or TLS 1.0.  What are the main attacks
which would be possible in this scenario?  The answer and
comments to this SO question seem to indicate that if the risk
of attack is proportionally low, more complexity will not
improve security but will add complexity. I would like to know
the highest risk areas for attack to determine the appropriate
counter-measures, if necessary.  share|improve this question
migrated from stackoverflow.com Mar 14 '13 at 18:39  This
question came from our site for professional and enthusiast
programmers.  1 Answer 1  up vote 3 down vote accepted  This is
a very broad question that can't be answered with anything near
sufficiency on Stack Overflow. You really need to read a book to
understand all of this. I highl