Justtechjobs.com Find a programming school near you






Online Campus Both


php3-list | 200003

RE: [PHP3] Session Management From: Josh Hartmann (josh <email protected>)
Date: 03/31/00

There is another exposure in putting the SID into the URL. It will show up
in the referrer log of any site that is clickable from your site. So if you
are protecting any sensitive information with sessions, you are advised not
to put the SID in the query string (as well as any other sensitive data).

-Josh

-----Original Message-----
From: Sascha Schumann [mailto:sascha <email protected>]
Sent: Friday, March 31, 2000 3:46 PM
To: Jeff Schwartz
Cc: PHP List
Subject: Re: [PHP3] Session Management

On Fri, Mar 31, 2000 at 12:27:29PM -0800, Jeff Schwartz wrote:
> For non-cookie based sessions, passing an ID in a form works great. But
> what about regular clickable URLs? The session ID is exposed. Someone at
> the next desk could type it in and become that user.

Heh. A new type of "eavesdropping." Unless you are robot, I don't think
you can memorize a string with 32 chars in one second.

> Is there any way to safeguard against that?

You can prevent real eavesdropping only using SSL/TLS.

- Sascha 

-- 
PHP 3 Mailing List <http://www.php.net/>
To unsubscribe, send an empty message to php3-unsubscribe <email protected>
To subscribe to the digest, e-mail: php3-digest-subscribe <email protected>
To search the mailing list archive, go to: http://www.php.net/mailsearch.php3
To contact the list administrators, e-mail: php-list-admin <email protected>