sessions protection
| From: | Vladislav Kulchitski | Date: | Wed, 17 Apr 2002 20:40:31 +0000 |
| Subject: | sessions protection | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-93395@lists.php.net to get a copy of this message | ||
Hi, can anyone advise about another issue that occurred to me.
Basically, let's say the cracker know that in my application I create a
session variable named "auth_user" for valid users. Is there a way to
hack into it if he knows this session variable name?
Example:
if($action==edit_personalinformation_update)
{
if(!session_is_registered("auth_user"))
{
stop_unauthorized(); // defined function that prints an error
message
return;
}
//SECURE OPERATIONS
}