Justtechjobs.com Find a programming school near you






Online Campus Both


php3-list | 200003

Re: [PHP3] Session Management From: Jeff Schwartz (jeff_schwartz <email protected>)
Date: 03/31/00

Why do they only have one second to see it?

If the session ID is part of the URL, it shows in the user's Address bar
as long as they're on that page, doesn't it?

--- Sascha Schumann <sascha <email protected>> wrote:
> On Fri, Mar 31, 2000 at 12:27:29PM -0800, Jeff Schwartz wrote:
> > For non-cookie based sessions, passing an ID in a form works great.
> But
> > what about regular clickable URLs? The session ID is exposed. Someone
> at
> > the next desk could type it in and become that user.
>
> Heh. A new type of "eavesdropping." Unless you are robot, I don't think
> you can memorize a string with 32 chars in one second.
>
> > Is there any way to safeguard against that?
>
> You can prevent real eavesdropping only using SSL/TLS.
>
> - Sascha
>

=====
jeff_schwartz <email protected> (Jeff Schwartz)

__________________________________________________
Do You Yahoo!?
Talk to your friends online with Yahoo! Messenger.
http://im.yahoo.com 

-- 
PHP 3 Mailing List <http://www.php.net/>
To unsubscribe, send an empty message to php3-unsubscribe <email protected>
To subscribe to the digest, e-mail: php3-digest-subscribe <email protected>
To search the mailing list archive, go to: http://www.php.net/mailsearch.php3
To contact the list administrators, e-mail: php-list-admin <email protected>