Re: [PHP4BETA] session security?

On Sun, Dec 05, 1999 at 03:05:28AM -0500, Cris Daniluk wrote: > It appears that you can use the fact that sessions will create > themselves to arbitrarily create sessions (ie > file.php?PHPSESSID=test).. I would also assume that since no IP > or other identifying information is stored within the session > (which would be hard to do because of proxies, etc) that you > could then put in any existing session that may or may not > belong to you and begin using it. And the problem is..? The way session ids are handled in the session module eases the construction of data-handling modules. Additionally, it speeds up the session initialization by following the simple policy "create it, if it does not exist." We could stop people from using arbitrary session ids, but I don't see any point in doing so, because it would not increase security. -- Regards, Sascha Schumann Consultant