Re: Re: Proposal for securing PHP sessions
| From: | Justin French | Date: | Sun, 08 Sep 2002 03:04:05 +0000 |
| Subject: | Re: Re: Proposal for securing PHP sessions | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-115638@lists.php.net to get a copy of this message | ||
on 08/09/02 5:04 AM, M1tch (m1tch101@hotmail.com) wrote:
> Why not just use IP?
> I created a nice system, whereby if your IP is changed (or someone is
> hacking your session), the session is destroyed, and the user must log in.
> Does not add much overhead either.
large ISPs like AOL use variable IPs (your IP could change from page to
page)... that's a pretty good reason to start with.
if people get disconnected, they too are likely to have a new IP on most
dial-up ISPs.
Justin