new session creation policy is trust user input ?
| From: | Giancarlo | Date: | Fri, 31 May 2002 22:16:10 +0000 |
| Subject: | new session creation policy is trust user input ? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-100175@lists.php.net to get a copy of this message | ||
What are the benefits of trusting any id provided by the user, when
creating a new session? Why should we allow users to create their own
session id, and maybe pass them around? Or being driven to some session
faked/created by someone else?
Can we control that a new session id has been effectively issued by us,
and only create new session id that we have generated?
Gian