note 8165 deleted from Session handling functions by sniper
| From: | sniper@php.net | Date: | Mon, 02 Jul 2001 09:57:48 +0000 |
| Subject: | note 8165 deleted from Session handling functions by sniper | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-14886@lists.php.net to get a copy of this message | ||
To php@apt7.com:
php-sessions *DOES NOT* store any session data in the client besides the session id. This means that
a user can takeover the session of another user if he knows (or guesses) the other user's
session id. (all web applications are vulnerable to this attack).
You can get a very good idea about how sessions work looking at http://phplib.netuse.de