Re: trans-sid warning?
| From: | Rasmus Lerdorf | Date: | Mon, 19 Aug 2002 22:50:15 +0000 |
| Subject: | Re: trans-sid warning? | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-87105@lists.php.net to get a copy of this message | ||
> matching ip limits the number of session hijackings to atleast the same
> network you are on (behind a fw/router which does nat), and the users who
> use the same http proxy as you (in case you use one)
>
> so its either expire/generate (rotate,morph,mutate) SID on each pageload, or
> the more popular sollution... IP match
IP match makes no sense. Someone's ip can change dramatically from one
click to the next due to dhcp leases timing out, roaming from one wireless
gateway to the next, coming through a round-robin dns batch of proxy
servers, etc.
-Rasmus