Re: Why are they more secure?
- From: AnrDaemon <anrdaemon@xxxxxxxxxxx>
- Date: Thu, 3 Apr 2008 00:51:19 +0400
Greetings, NC.
In reply to Your message dated Monday, March 31, 2008, 22:27:18,
every sane developer does not believe in session ID itself, but insted
he/she use the SessionID+$_SERVER['REMOTE_ADDRESS'] combination.
And whenever the second one changed, either reset session or discard
cookie sent.
This is the recipe for trouble with AOL users, whose IP addresses may
change sporadically.
Bad for them, if it is true. And there is always a chance for normal ISP with
sane routing schemes.
Not to mention the fact that IP address is fairly easy to spoof...
It is a bit off-topic here as it is a matter of lower-level network conflict
resolution. At application level, You have little chance to detect such
attacks, if they passed through network layer.
In closing, if Your data THAT sensitive (or You're that paranoidal), use
HTTPS.
--
Sincerely Yours, AnrDaemon <anrdaemon@xxxxxxxxxxx>
.
- Prev by Date: Re: [Sessions] Why are they more secure?
- Next by Date: Re: Why are they more secure?
- Previous by thread: Re: Why are they more secure?
- Next by thread: Re: Extract text and images from pdf file
- Index(es):
Relevant Pages
|
