Re: Re: Proposal for securing PHP sessions
| From: | M1tch | Date: | Sun, 08 Sep 2002 10:07:13 +0000 |
| Subject: | Re: Re: Proposal for securing PHP sessions | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-115649@lists.php.net to get a copy of this message | ||
Ooooh, it's a lesson every day! Right, back to the drawing board :(
"Justin French" <justin@indent.com.au> wrote in message
news:B9A0FB44.FFD9%justin@indent.com.au...
> on 08/09/02 5:04 AM, M1tch (m1tch101@hotmail.com) wrote:
>
> > Why not just use IP?
> > I created a nice system, whereby if your IP is changed (or someone is
> > hacking your session), the session is destroyed, and the user must log
in.
> > Does not add much overhead either.
>
> large ISPs like AOL use variable IPs (your IP could change from page to
> page)... that's a pretty good reason to start with.
>
> if people get disconnected, they too are likely to have a new IP on most
> dial-up ISPs.
>
> Justin
>
>