Re: Session Authentication

Ólafur Waage escribió:

Lets say i have a login system. This system authenticates the user via mysql, when the user is authenticated, i set a session variable to let the system know the user is authenticated. ie. $_SESSION["authenticated"] = true; Lets also say i know that's how the system works, that a session variable within my browser is set to true. Could i do this if i knew all this info and "authenticate" myself by setting the variable from the client side?

The only way I know is, if you use transid (transparent session id), the cracker could hijack your session id and the system would think that it's you (suppose that it's your session that got hijacked)

If it is possible, what can i do to prevent this or increase security?

Yes: Don't use transparent session id, or even better, save the authentication in a cookie on the client (seperated from the session array). -- select 'mmarques' || '@' || 'unl.edu.ar' AS email; --------------------------------------------------------- Martín Marqués | Programador, DBA Centro de Telemática | Administrador Universidad Nacional del Litoral ---------------------------------------------------------