RE: [PHP] session data vs cookie data

> -----Original Message----- > From: Erik Price [mailto:pricee@hhbrown.com] > Sent: Wednesday, January 30, 2002 3:30 PM > To: PHP > Subject: [PHP] session data vs cookie data > > > I have read elsewhere that depending on Cookie data for site > authentication is false economy, because Cookie data can be spoofed. > True > > I'm designing a login that auto-fills a person's name into a > field for > authentication (based on their $user_id, which is stored in > the cookie), > then they enter a password below that name and the fields are checked > against data stored in MySQL. Standard authentication > system. But from > that point onward, I'd like to use a session variable that > establishes > the user's legitimacy as having logged in, using the cookie > to store the > SESSID. > > Barring the user spoofing the SESSID in the cookie, could > someone easily > fake legitimacy? I would think not, since the session data > ("$logged_in = 1" or something similar) is not stored in the > cookie but > rather on the server. But I just want to confirm. > It is possible to "steal" a session because a session_id is usually based on a cookie. So I always store the IP, HTTP_X_FORWARD and USER_AGENT in the session. And check them every page. kind regards, Jerry > > I should mention that I have register_globals = off in > php.ini (4.1.0 on > Linux). > > > Thanks, > Erik > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: > php-list-admin@lists.php.net > The information contained in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any form of disclosure, production, distribution or any action taken or refrained from in reliance on it, is prohibited and may be unlawful. Please notify the sender immediately. The content of the email is not legally binding unless confirmed by letter bearing two authorized signatures.