Re: Need opinion On sessions - Cookies mandatory?

At 09:00 AM 1/23/2002 +0100, Nick Wilson wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 * and then SpamSucks86 blurted.... to use sessions to do this. Should I make cookies mandatory, or should I use the SID constant (defined if the PHP 4.0 session functions could not set a cookie) and append the session ID to urls in case cookies can't be I don't think you need do either, I'm a little vague on the details but my site and others I've worked on all use sessions with no appending and no 'you must have cookies enabled nonsense'

If cookies do not work, then you must have a session_id appended to the URL. HTTP is a "stateless" protocol. So every time you make a request via HTTP, you must let PHP know what the session_id is either through cookies, or url query strings (or possibly posted with a form).

disable cookies, but appending the session ID could be a security risk. Consider this: Someone is viewing a page and says "oh cool, I want Joe to see this". He then copy/pastes the URL, sessionID and all, to Joe, who then loads up the page using his friend's SessionID. With cookies, this would not happen. Not a problem. The session is *destroyed* as soon as a user closes the browser.

A session will only be *destroyed* if it uses a cookie. PHP never knows when you close the browser, but the browser will remove the cookie. Next time you fire up the browser, it will not send the cookie, and a different session will be started.

So basically, I'm asking, is the convenience of not requiring cookies more important than the possible security risk of putting the sessionID in the URL? Secondly, is there a way to avoid this type of situation. Thanks for any responses! =) I think a thorough read of the docs is in order at this point as I lack the techinical details but I think you'll find that you don't have any of these worries and it'll all be cool in the end.

In my personal experience, using cookies only has not proven to be a problem. Your call.

Good luck. - -- Nick Wilson

Tel:    +45 3325 0688
Fax:    +45 3325 0677
Web:    www.explodingnet.com

Jason Garber IonZoft.com

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) iD8DBQE8Tm2yHpvrrTa6L5oRAs2KAJoC81h3KQ1IP2Iaip63+0wGQYP/egCfblFC e1N/buZsAIfBfc1gZYXxukI= =u5N1 -----END PGP SIGNATURE----- -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net