Re: losing session data with cross-site scripting

Steve Lefevre wrote:

I have a php site on a production server. The production server doesn't have the spell libraries, and rather than migrate the site, we setup spell checking functions on the development site, and shuttled the users back and forth with specially crafted get links and forms. The POST form or GET link on the production site contains the string to be spellchecked. Once the user is at the development site, the string is spellcheck, and corrected if necessary. The development site checks the http referrer to make sure it's not just anybody, and the only thing it does is spell checking, anyway.

Many users disable or set their browsers to spoof referrer headers. This isn't a good thing to rely on and it may well be causing your problem. -- Jasper Bryant-Greene Freelance web developer http://jasper.bryant-greene.name/