Re: Re: Proposal for securing PHP sessions

Nope, have no idea... I've just allways been told (and adhered to) the rule that you don't trust anything client side, which would include IP address'. Even if you could get it working for AOL, what about some other ISP located in Australia, South Africa, or anywhere else on the planet that you've never heard of? Don't trust IPs. AOL was just an example. Justin on 08/09/02 8:50 PM, M1tch (m1tch101@hotmail.com) wrote: > Just out of curiosity, do you know if any part (e.g. x1.x2.x3.x4) of the IP > remains static when AOL changes it? Even if it's only the first part, that's > better than nothing. > I'm having a headache now, because I'm already behind schedule, and this has > just thrown a spanner in the works :( (but still thanks for bringing it up > now, rather than at production time!) > > > "Justin French" <justin@indent.com.au> wrote in message > news:B9A0FB44.FFD9%justin@indent.com.au... >> on 08/09/02 5:04 AM, M1tch (m1tch101@hotmail.com) wrote: >> >>> Why not just use IP? >>> I created a nice system, whereby if your IP is changed (or someone is >>> hacking your session), the session is destroyed, and the user must log > in. >>> Does not add much overhead either. >> >> large ISPs like AOL use variable IPs (your IP could change from page to >> page)... that's a pretty good reason to start with. >> >> if people get disconnected, they too are likely to have a new IP on most >> dial-up ISPs. >> >> Justin >> >> > >