Re: About Session And Cookies

From: Date: Wed, 29 Aug 2007 21:33:29 +0000
Subject: Re: About Session And Cookies
References: 1 2 3  Groups: php.general 
Request: Send a blank email to php-general+get-261515@lists.php.net to get a copy of this message
At 10:52 PM +0200 8/18/07, Michelle Konzack wrote:
Am 2007-08-17 22:07:47, schrieb Bastien Koert:
If cookies are not available, you can either hide the id in the hidden form field element or enable trans_sid to automatically pass the session id in the url
This will be a security risk since Session-Hijacker can grap the URL Greetings 
    Michelle Konzack
    Systemadministrator
    Tamay Dogan Network
    Debian GNU/Linux Consultant
When the user first generates a session id, grab the user's ip and store both in mysql. In the code, always check the session id against the user's ip before doing anything. If they don't match with what you started with, then stop. That should stop most Session-Hijackers, don't you think? Cheers, tedd PS; Back from vacation, and all ready to be retrained. -- ------- http://sperling.com http://ancientstones.com http://earthstones.com

« previous php.general (#261515) next »