Re: Storing passwords in session variables

From:	Marco Behnke	Date:	Tue, 11 Dec 2012 20:35:53 +0000
Subject:	Re: Storing passwords in session variables
References:	1 2	Groups:	php.general
Request:	Send a blank email to php-general+get-319841@lists.php.net to get a copy of this message

Am 11.12.2012 20:51, schrieb Peet Grobler:

On 2012/12/11 2:46 PM, Paul Halliday wrote:
Client <-> Server is encrypted, can I toss these into session variables?
Do note your full url (including &user=xx&pass=yy will be logged in apache logs, and depending on configuration in squid logs in-between too.

Normally you would pass credential as post variables or even better use http auth for that. (read about http code 401 How to send in HTTP: http://en.wikipedia.org/wiki/Basic_access_authentication Read in auth vars in PHP: http://php.net/manual/de/features.http-auth.php

-- Marco Behnke Dipl. Informatiker (FH), SAE Audio Engineer Zend Certified Engineer PHP 5.3 Tel.: 0174 / 9722336 e-Mail: marco@behnke.biz Softwaretechnik Behnke Heinrich-Heine-Str. 7D 21218 Seevetal http://www.behnke.biz

Attachment: [application/pkcs7-signature] S/MIME Kryptografische Unterschrift smime.p7s