note 86482 deleted from session.security by salathe
| From: | salathe@php.net | Date: | Mon, 21 Sep 2020 14:46:25 +0000 |
| Subject: | note 86482 deleted from session.security by salathe | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-215299@lists.php.net to get a copy of this message | ||
Note Submitter: Olle Bergkvist
----
It is also quite important to (somehow) make sure that the cookies you're setting (including
the session cookie) is only visible to the site that created it (or to other trusted sites only).
If the cookie's path is set to '/' (the whole domain), then any website on the same
domain (might be lots of websites) _will_ get the cookie through HTTP headers and could possibly
hijack your session.
One slightly acceptable protection would be to lock a session to one IP adress.