Re: sessions and security
| From: | K.Simon | Date: | Wed, 27 Dec 2000 12:23:43 +0000 |
| Subject: | Re: sessions and security | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-31954@lists.php.net to get a copy of this message | ||
What about timeout?
*********** REPLY SEPARATOR ***********
On 27/12/2000 at 18:22 Anuradha Ratnaweera wrote:
>On Wed, 27 Dec 2000, K.Simon wrote:
>
>> To avoid this you could use javascript. Put in there an exit console
>> destroing the session if the user closes the browser.
>
>Users can easily disable javascipt, and this won't work on some browsers
>properly.
>
>What I am really worried is if a user is accessing through a proxy,
>whether someone with full access to the proxy can do something by using
>the URL and hence the session ID, even with SSL (if not using cookies).
>
>Anuradha
>
>
>--
>PHP General Mailing List (http://www.php.net/)
>To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net
>For additional commands, e-mail: php-general-help@lists.php.net
>To contact the list administrators, e-mail: php-list-admin@lists.php.net