Re: Re: Security Issues - Where to look?
| From: | Richard Lynch | Date: | Thu, 10 Nov 2005 23:05:08 +0000 |
| Subject: | Re: Re: Security Issues - Where to look? | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-225580@lists.php.net to get a copy of this message | ||
On Thu, November 10, 2005 3:29 pm, GamblerZG wrote:
>> IMO, the best way is to re-generate SIDs on each request, but such
>> method will decrease perfomance of a script.
But if Cookies are off, you just destroyed their "Back" button in
their browser, which should be a crime.
Re-generate only when permission levels are crossed from "normal" user
to "admin" -- or even just make them login again (or at least provide
password) at that point.
--
Like Music?
http://l-i-e.com/artists.htm