Re[2]: [PHP] secure site question

Hi, Thursday, April 24, 2003, 3:48:42 AM, you wrote: JG> If you set your session domain (for the cookie) to ".xxx.com" any 3rd level JG> domain on xxx.com will be able to read it, so it will be visible to both JG> www.xxx.com and secure.xxx.com. http://xxx.com will not be JG> able to read it, JG> however. If the directory where your sessions are stored is readable by JG> both www and secure, you should be good to go (if using native session JG> handlers). Just passing the session ID as part of the URL seems sort of JG> insecure to me, but it's really a 1/2 dozen of 1, 6 of the other situation. >> -----Original Message----- >> From: Tom Rogers [mailto:trogers@kwikin.com] >> Sent: Wednesday, April 23, 2003 7:37 AM >> To: Michael Lewis >> Cc: php-general@lists.php.net >> Subject: Re: [PHP] secure site question >> >> >> Hi, >> >> Thursday, April 24, 2003, 12:26:04 AM, you wrote: >> ML> I'm having a problem and I'm not quite sure what the best way >> to solve it is >> ML> so I'm looking for some guidance. I have an e/COMMERCE site that uses >> ML> sessions named www.xxx.com. The final step (payment) involves >> getting credit >> ML> card information so I bop over to >> ML> https://secure.xxx.com >> which serves up the >> ML> page correctly. The problem is that it knows nothing about my previous >> ML> session so the cart and login information is no longer there. >> How can I let >> ML> the secure page know what's going on with the order? I'm >> trying to avoid a >> ML> kludge here so I'm hoping someone has already faced this problem. >> >> ML> Thanks >> >> >> You also have to pass the sessionid and use that to restart the >> session. You can do that in the url >> https://secure.xxx.com?sess=xxxxxxxx >> >> Then >> >> if(isset($_GET['sess'])){ >> session_id($_GET['sess']); >> } >> session_start(); >> -- >> regards, >> Tom >> >> >> -- >> PHP General Mailing List (http://www.php.net/) >> To unsubscribe, visit: http://www.php.net/unsub.php >> session id's are passed anyway in the url as part of normal session behaviour even when using cookies the first go has to be by url sometimes and also if cookies are disabled. The whole session system is not secure by design when it comes down to it :) -- regards, Tom