Re: sessions and security

To avoid this you could use javascript. Put in there an exit console destroing the session if the user closes the browser. *********** REPLY SEPARATOR *********** On 25/12/2000 at 19:22 Richard Lynch wrote: >The session variables all live on the server -- So only somebody who has >already compromised your server could access them directly. That would mean >you have bigger problems than your web sessions. > >There's a possibility of somebody sniffing the extremely unpredictable >session ID (md5 hash of a randomly-generated value)... But on an SSL >connection, that's encrypted, I think. > >The only *real* risk is users walking off with their browsers still going, >and somebody else coming along and using it. Only user-education will make >that more secure. > >----- Original Message ----- >From: Anuradha Ratnaweera <anuradha@gnu.org> >Newsgroups: php.general >Sent: Thursday, December 21, 2000 10:38 PM >Subject: [PHP] sessions and security > > >> >> Hi all, >> >> I have just joined the mailing list, so pardon me if this issue has >> already been discussed here. Can anybody direct me to some documentation >> on security with session managements. I am wondering if I have a URL based >> session system and if a visitor accesses my site (over SSL) through a >> proxy, whether someone with access to the proxy logs can access session >> variables? >> >> Thanks in advance. >> >> >> Anuradha >> >> >> -- >> PHP General Mailing List (http://www.php.net/) >> To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net >> For additional commands, e-mail: php-general-help@lists.php.net >> To contact the list administrators, e-mail: php-list-admin@lists.php.net >> > > >-- >PHP General Mailing List (http://www.php.net/) >To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net >For additional commands, e-mail: php-general-help@lists.php.net >To contact the list administrators, e-mail: php-list-admin@lists.php.net