Sv: [phplib] cookie security From: Klaus Seidenfaden (ks <email protected>)
Date: 05/02/01

D. Sebastien Taggart wrote:

>Is it unwise to update the session as opposed to destroying it and creating
>a new one, carrying over the vars server side where I can validate them
>(double validate) just in case the user tampered with her cookie?

If it is just a session cookie (it is, if it is generated by page_open()), it only contains the session id. Variables stay in a database, server-side. Session ids are md5 hashes of a quasi-random value, so it is highly unlikely that someone can sneak into somebody else's session by tampering with the session id. Also, I believe session cookies are kept in memory, so they shouldn't be accessible for tampering (but there's always the query string, of course).

So what I'm saying is: Just reuse the session. But then again, I'm a newbie myself, so don't trust me one bit! :-)

-- Klaus.

---------------------------------------------------------------------
To unsubscribe, e-mail: phplib-unsubscribe <email protected>
For additional commands, e-mail: phplib-help <email protected>