Re: Cookies & sessions
| From: | clancy_1 at cybec dot com dot au | Date: | Sun, 24 Jan 2010 06:17:27 +0000 |
| Subject: | Re: Cookies & sessions | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-301389@lists.php.net to get a copy of this message | ||
On Sat, 23 Jan 2010 09:32:37 -0500, tedd.sperling@gmail.com (tedd) wrote:
>At 1:13 PM +1100 1/23/10, clancy_1@cybec.com.au wrote:
>> but I would be grateful for any suggestions how I
>>could make this procedure more secure.
>
>We have given you advice that you should NOT use Cookies in any
>fashion to secure your site, but you remain steadfast that you know
>better -- so, what else can we say other than good luck.
BUT you have told me to use sessions, and sessions use a Cookie!
If the Cookie I use contains random data, the only difference in security is in the time
that it remains valid. Neither contains any useful information, but while they are valid
both will enable you to bypass security.