Re: Patch to minimize session fixation (continued)
| From: | Sean Coates | Date: | Wed, 07 Apr 2004 16:08:22 +0000 |
| Subject: | Re: Patch to minimize session fixation (continued) | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-8966@lists.php.net to get a copy of this message | ||
While I like that your patch can be turned on and off in the INI, this sounds much more like an application-level problem, and thus should be implemented at the application level.
MHO.
S
inodes wrote:
I agree with all your arguments: the IP-base solution IS NOT perfect. It is not generic enough to be implemented in world-wide application, but it can be useuful for intranet or extranets. That's to say cases when you know the infrastructure used by the clients to connect to your server support this strategy. My goal is to minimize the risks for now, since I don't know yet what the perfect solution could be. Other tests could be made: - on the browser headers - on IP ranges rather that on the single client IP address - and so on... Jerome