Re: Re: Proposal for securing PHP sessions

Just out of curiosity, do you know if any part (e.g. x1.x2.x3.x4) of the IP remains static when AOL changes it? Even if it's only the first part, that's better than nothing. I'm having a headache now, because I'm already behind schedule, and this has just thrown a spanner in the works :( (but still thanks for bringing it up now, rather than at production time!) "Justin French" <justin@indent.com.au> wrote in message news:B9A0FB44.FFD9%justin@indent.com.au... > on 08/09/02 5:04 AM, M1tch (m1tch101@hotmail.com) wrote: > > > Why not just use IP? > > I created a nice system, whereby if your IP is changed (or someone is > > hacking your session), the session is destroyed, and the user must log in. > > Does not add much overhead either. > > large ISPs like AOL use variable IPs (your IP could change from page to > page)... that's a pretty good reason to start with. > > if people get disconnected, they too are likely to have a new IP on most > dial-up ISPs. > > Justin > >