Re: trans-sid warning?

From: Date: Tue, 20 Aug 2002 22:29:54 +0000
Subject: Re: trans-sid warning?
References: 1  Groups: php.dev 
Request: Send a blank email to php-dev+get-87206@lists.php.net to get a copy of this message
At 05:31 PM 8/20/02 +0200, Tit \"Black\" Petric wrote:
the ip match should be implemented too, but trough a php.ini switch, since i see how that behaviour might not be desired from your comment above, i would default it to off thou, let the user/admin/whatnot change it if they desire to do that.
What part of "YOU CAN'T RELY ON IP ADDRESSES FOR AUTHENTICATION!!!" don't you understand? IT DOES NOT WORK! PERIOD... EVER, at least on the real Internet world! I've seen a page request, and the images on that page come from different IP addresses in the AOL block of addresses. I know they came from the same browser, yet they show different IP addresses. AOL is not the only place that proxies/caches traffic from their users. You can't trust IP addresses to match with the browser they came from, not even within one single page load. Rick

« previous php.dev (#87206) next »