RE: [PHP] custom session management and authentication

> -----Original Message----- > From: Brad Pauly [mailto:brad@robinsontech.com] > Sent: 24 October 2002 16:57 > > On Thu, 2002-10-24 at 09:38, Jaime Bozza wrote: > > > > Isn't this pretty much exactly the same as PHP4's session > support? PHP > > It certainly could be. I came to PHP from ColdFusion where I started > doing this because I wanted more control over sessions and I > think this > method is more secure. It worked well, so I did it with PHP > too. I will > need to read up some more, but the big benefit is in the way client > authentication works. The session id is not stored on the > client. It is > retrieved from the authentication token. This makes it more > difficult to > guess a session id. Huh? I don't understand. You must have something client side, whether a cookie or something in the URL, to identify the session to use for that client, even if indirectly -- how is this *not* a session id? *If* someone can guess a valid value of this "authentication token"/session ID, they can hijack a session. It seems just as likely that they could guess your "authentication token" as they could PHP's lots-of-random-characters session ID -- or am I missing something? Actually, in a flash of inspiration I think I see that I am missing a step -- I'm just not sure what it is! Please explain so I can see if I was getting even close...!! Cheers! Mike --------------------------------------------------------------------- Mike Ford, Electronic Information Services Adviser, Learning Support Services, Learning & Information Services, JG125, James Graham Building, Leeds Metropolitan University, Beckett Park, LEEDS, LS6 3QS, United Kingdom Email: m.ford@lmu.ac.uk Tel: +44 113 283 2600 extn 4730 Fax: +44 113 283 3211