RE: [PHP] Why do Sessions use Cookies?
| From: | Ahmed Saad | Date: | Wed, 07 Dec 2005 11:51:50 +0000 |
| Subject: | RE: [PHP] Why do Sessions use Cookies? | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-227033@lists.php.net to get a copy of this message | ||
Hi Michael,
On 12/3/05, Michael B Allen <mba2000@ioplex.com> wrote:
> Why do sessions use cookies?
'cause HTTP is a "stateless" protocol ... check
Wikiepedia on HTTP Cookies at http://en.wikipedia.org/wiki/HTTP_cookies
and RFC 2109 http://www.cse.ohio-state.edu/cgi-bin/rfc/rfc2109.html
such "statelessness" is the source of one of the major attack types in
Web applications: Session Hijacking... Chris has more to say here
http://shiflett.org/articles/security-corner-aug2004
(hello Chris :)
>Isn't a session just a container associated
> with the user's socket
No it's not, 'cause if so, the clien has to keep a socket open to the
server during the "whole" session... statelessness has design benefits
..
Regards,
Ahmed