Session Authentication
| From: | Ólafur Waage | Date: | Mon, 09 Apr 2007 12:39:53 +0000 |
| Subject: | Session Authentication | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-252299@lists.php.net to get a copy of this message | ||
Lets say i have a login system. This system authenticates the user via
mysql, when the user is authenticated, i set a session variable to let the
system know the user is authenticated. ie. $_SESSION["authenticated"] =
true;
Lets also say i know that's how the system works, that a session variable
within my browser is set to true. Could i do this if i knew all this info
and "authenticate" myself by setting the variable from the client side?
If it is possible, what can i do to prevent this or increase security?