Re: Cookie Problem

On 28 Apr 2004 Curt Zirzow wrote: > Unfortantly this really has to be done manually, there really isn't > any built in system that securely handles this situation. Figured as much ... > This is very close on how I would handle it. The biggest difference > is I would make the random key as long as possible (md5 or sha1) > hash. Well for that matter why not just use the session ID? Both it and the random key share the same characteristic: If picked up within the 30- second time limit they coudl theoretically be used to steal the session. Is there really any advantage to the random key? I mean one more layer of security may help, but the other side of that is not to fall into thinking that extra layers necessarily mean extra security. -- Tom