session security?
| From: | Cris Daniluk | Date: | Sun, 05 Dec 1999 08:05:28 +0000 |
| Subject: | session security? | ||
| Groups: | php.version4 | ||
| Request: | Send a blank email to php-version4+get-7433@lists.php.net to get a copy of this message | ||
It appears that you can use the fact that sessions will create themselves to arbitrarily create
sessions (ie file.php?PHPSESSID=test).. I would also assume that since no IP or other identifying
information is stored within the session (which would be hard to do because of proxies, etc) that
you could then put in any existing session that may or may not belong to you and begin using it.
The latter part of this message seems to me to be more or less a trade in for the power of
sessions--there's no real way around it minus some type of authentication, but the first part
seems kind of significant...
Cris Daniluk