Re: [PHP4BETA] session security?
| From: | Sascha Schumann | Date: | Sun, 05 Dec 1999 18:17:26 +0000 |
| Subject: | Re: [PHP4BETA] session security? | ||
| References: | 1 2 3 | Groups: | php.version4 |
| Request: | Send a blank email to php-version4+get-7453@lists.php.net to get a copy of this message | ||
On Sun, Dec 05, 1999 at 12:52:47PM -0500, Cris Daniluk wrote:
> It's a problem if people are crawling around in everyone else's sessions,
> don't you think? That's pretty insecure...
That presumes that the attacker knows the session ids.
Sessions are only secure, if you guard the session ids from
being revealed.
--
Regards,
Sascha Schumann
Consultant