Re: trans-sid warning?
| From: | Sascha Schumann | Date: | Mon, 19 Aug 2002 23:38:29 +0000 |
| Subject: | Re: trans-sid warning? | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-87108@lists.php.net to get a copy of this message | ||
On Mon, 19 Aug 2002, Rasmus Lerdorf wrote:
> Well, while it is true that it is impossible to completely prevent, our
I've been through this argument a couple of times and I don't
plan to spend more time on it.
If you want your site to be safe, enable
session.use_only_cookies and be done with it. No amount of
checking on the server side can otherwise prevent this class
of attacks.
- Sascha