note 86482 added to session.security

It is also quite important to (somehow) make sure that the cookies you're setting (including the session cookie) is only visible to the site that created it (or to other trusted sites only). If the cookie's path is set to '/' (the whole domain), then any website on the same domain (might be lots of websites) _will_ get the cookie through HTTP headers and could possibly hijack your session. One slightly acceptable protection would be to lock a session to one IP adress. ---- Server IP: 80.67.2.2 Probable Submitter: 81.227.146.88 ---- Manual Page -- http://www.php.net/manual/en/session.security.php Edit -- https://master.php.net/note/edit/86482 Del: integrated -- https://master.php.net/note/delete/86482/integrated Del: useless -- https://master.php.net/note/delete/86482/useless Del: bad code -- https://master.php.net/note/delete/86482/bad+code Del: spam -- https://master.php.net/note/delete/86482/spam Del: non-english -- https://master.php.net/note/delete/86482/non-english Del: in docs -- https://master.php.net/note/delete/86482/in+docs Del: other reasons-- https://master.php.net/note/delete/86482 Reject -- https://master.php.net/note/reject/86482 Search -- https://master.php.net/manage/user-notes.php