Re: Session Authentication
| From: | Martin Marques | Date: | Mon, 09 Apr 2007 15:38:45 +0000 |
| Subject: | Re: Session Authentication | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-252331@lists.php.net to get a copy of this message | ||
Tijnema ! escribió:
On 4/9/07, Martin Marques <martin@bugs.unl.edu.ar> wrote:So what? The user authenticated himself, so what is he gonna crack? You want better info on this subject, see how webmail apps store the suthentication information (gmail.com comes to mind now). -- select 'mmarques' || '@' || 'unl.edu.ar' AS email; --------------------------------------------------------- Martín Marqués | Programador, DBA Centro de Telemática | Administrador Universidad Nacional del Litoral ---------------------------------------------------------Yes: Don't use transparent session id, or even better, save the authentication in a cookie on the client (seperated from the session array).And then the user would crack the cookie .... I know they are encrypted, but trust me, cookies can be edited.