Re: Re: Security Issues - Where to look?
| From: | GamblerZG | Date: | Thu, 10 Nov 2005 21:08:04 +0000 |
| Subject: | Re: Re: Security Issues - Where to look? | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-225564@lists.php.net to get a copy of this message | ||
Chris Shiflett wrote:
GamblerZG wrote:I agree that using only IP to identify session is bad. Using only SID is ok. Using SIDs that are tied to a single IP is even _more secure_, since the possible attacker would need to have exactly the same IP as a victim of session hijacking. This comes at a price of a small inconvinience for dial-up users (since they would need to login on each reconnect), but I think such price it reasonable. IMO, the best way is to re-generate SIDs on each request, but such method will decrease perfomance of a script.I think it's still reasonable to restrict a session to a single IP.No, it's not, for all of the reasons Richard mentioned and more.