note 28681 added to function.setcookie

Some versions of IE6, when you drop a non-persistent cookie, handle this incorrectly and instead drop a persistent cookie. This is not PHP's fault: ) Rather it is a bug in these versions of IE6. I am posting this because people may be programming session IDs and tokens in what they believe to be non-persistent cookies. Specifically, IE6 build 6.0.2800.1106CO (SP1) does this. IE6, in this case, will make your application insecure. You should notify IE6 users to manually delete their cookies after their session is completed. Will they do this, no. At least you did your part to notify them of the risk. We found this to be true after an ethical hack which condemned the use of SessionID's in query string, even if the entire session begins, happens, and ends, in https. M$ Proxy Server (here we go with M$ crappy security) writes these session ID's to it's proxy logs. Since Proxy Server is easily comprimised with numerous well known hacks, your sessions can be. I have seen the logs and seen the sessionid's in https. Unfortunately, these EH fellows are forgetting that most user's systems are less secure and less patched than most ISP's and corporate proxy servers. We are simply moving the vulnerability to the client by using cookies. If it were up to me, I would leave sessionid in query string. I was proven right in the case with this browser. thx Neil -- http://www.php.net/manual/en/function.setcookie.php http://master.php.net/manage/user-notes.php?action=edit+28681 http://master.php.net/manage/user-notes.php?action=delete+28681 http://master.php.net/manage/user-notes.php?action=reject+28681