Re: [PHP4BETA] session security?

It's a problem if people are crawling around in everyone else's sessions, don't you think? That's pretty insecure... ----- Original Message ----- From: Sascha Schumann <sascha@schumann.cx> To: Cris Daniluk <cris@dsnet.net> Cc: <php4beta@lists.php.net> Sent: Sunday, December 05, 1999 7:58 AM Subject: Re: [PHP4BETA] session security? > On Sun, Dec 05, 1999 at 03:05:28AM -0500, Cris Daniluk wrote: > > It appears that you can use the fact that sessions will create > > themselves to arbitrarily create sessions (ie > > file.php?PHPSESSID=test).. I would also assume that since no IP > > or other identifying information is stored within the session > > (which would be hard to do because of proxies, etc) that you > > could then put in any existing session that may or may not > > belong to you and begin using it. > > And the problem is..? > > The way session ids are handled in the session module eases > the construction of data-handling modules. Additionally, it > speeds up the session initialization by following the simple > policy "create it, if it does not exist." > > We could stop people from using arbitrary session ids, but I > don't see any point in doing so, because it would not > increase security. > > -- > > Regards, > > Sascha Schumann > Consultant >