Re: PHPSESSID disclosed in URL?

If you don't use cookies, the id is going to be in the URL. And yes, you are too paranoid. There is nothing inherently safer about having the session id in a cookie or in POST data. The user can still see it rather easily. -Rasmus On Wed, 8 May 2002, Andre Dubuc wrote: > Setup: PHP 4.1.2 + Apache 1.3.23 + PostgreSQL 7.2 > register_globals=off, method=post; register_argc_argv=off; > magic_quotes_gpc=off; using: $_SESSION[] and $_POST[] > > Now for the question (and I'm asking this because of my limited understanding > on security measures): > > Each script page begins with "session_register();", and all works well. > However, when I first fire up my website locally, I see something similar to: > > > http://localhost/rap.php?PHPSESSID=a2604374903c616c9cd34e13c0ceed98 > > I understand that this is the session id, but why is it displayed in the URL? > That doesn't strike me as a very safe idea! Am I wrong in being concerned, or > am I turning paranoid? I am concerned since no other argument appears in the > URL except this one. (Btw, I've also have "$session=session_id()" at the end > of each script to pass the variables from other pages. Would this cause a > security hole?) > > Any advice or insights would be greatly appreciated, > Tia, > Andre > > > -- > Please pray the Holy Rosary to end the holocaust of abortion. > Remember in your prayers the Holy Souls in Purgatory. > > May God bless you abundantly in His love! > For a free Cenacle Scriptural Rosary Booklet: > http://www.webhart.net/csrb/ > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php >