Re: trans-sid warning?
| From: | Alan Knowles | Date: | Wed, 14 Aug 2002 13:46:05 +0000 |
| Subject: | Re: trans-sid warning? | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-86824@lists.php.net to get a copy of this message | ||
Can we not document the real issues about this in the manual, and just say something like
There are security issues in using any type of sessions with HTTP, please read the manual at
http://www.php.net/en/manual/security.sessions.html
for a more detail discussion on this subject..
regards
Alan
Rasmus Lerdorf wrote:
As much as I think trans-sid sucks from a performance perspective, what's with this comment in php.ini-dist? ; trans sid support is disabled by default. ; Use of trans sid may risk your users security. It may not be ; feasible to use this option for some sites. Use this option with caution. session.use_trans_sid = 0 What security issue is this referring to? -Rasmus