php-general | 2001062

Re: [PHP] Stopping stolen / spoofed / linked sessions From: Rasmus Lerdorf (rasmus <email protected>)
Date: 06/30/01

> > Ok, stop right there. Sessions and authentication have nothing to do with
> > each other. To create a secure authenticated site you should be using
> > HTTP-based authentication over SSL. Sessions are simply for maintaining
> > state across http requests and have nothing to do with authentication.
> >
> > -Rasmus
>
> So setting a 'loggedin' session variable once a person has authenticated, and
> checking for that session variable each request before proceeding is not ok?

No, this is what I was trying to make sure people realized. It is only ok
if this happens over SSL and there is no chance that someone else can
sniff the session id.

-Rasmus 

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: php-general-unsubscribe <email protected>
For additional commands, e-mail: php-general-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>