Re: Re: Security Issues - Where to look?
| From: | GamblerZG | Date: | Fri, 11 Nov 2005 17:19:39 +0000 |
| Subject: | Re: Re: Security Issues - Where to look? | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-225636@lists.php.net to get a copy of this message | ||
Richard Lynch wrote:
On Thu, November 10, 2005 3:29 pm, GamblerZG wrote:Call me evil, but I prefer not to use GET-based sessions (after seing at least 3 websites hacked because of that stuff), so users without cookies can't login anyway.But if Cookies are off, you just destroyed their "Back" button in their browser, which should be a crime.IMO, the best way is to re-generate SIDs on each request, but such method will decrease perfomance of a script.