note 8493 deleted from Session handling functions by jmcastagnetto
| From: | jmcastagnetto@php.net | Date: | Thu, 14 Sep 2000 11:27:05 +0000 |
| Subject: | note 8493 deleted from Session handling functions by jmcastagnetto | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-4979@lists.php.net to get a copy of this message | ||
is there a way to stop session hijacking?
If a user is authenticated using a session, there is nothing stopping in finding the session id,
appending it to the URL in a new browser and taking over their session.
I tried using the REMOTE_ADDR field, but some ISP POST form variables from a different IP to GET
requests and, users using a proxy are prone to error.
Any ideas would be great.