Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6252

Re: sessions causing refreshing not to work

Followups directed to: comp.lang.php

Show all headers | View raw

Peter H. Coffin wrote:

> On Tue, 05 Jun 2012 06:46:28 +0200, Thomas 'PointedEars' Lahn wrote:
>>> Set session.use_trans_sid, unset session.use_cookie, don't forget to
>>> grab the session ID out of the $_GET array for every page load. Yes,
>>> your URLs will be ugly, and it'll be not impossible for someone to end
>>> up screwing things somehow with URL bookmarking or sharing.
>>
>> More importantly, it will be a security hole to be exploited:
>>
>><https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Manage_Session_ID_as_Any_Other_User_Input>
> 
> Sorry, I refuse to think of what *should be* expected behavior

It is by no means expected behavior.

> as a "security hole". People can manipulate cookie values almost as easily

Because of that, HTTP-only cookies have been invented.

> and they're no more trustworthy than a $_GET result.

Correct, but by contrast they are not stored unencrypted in the user's 
history, cannot be accidentally transmitted, and so on.

> This doesn't even bear discussing separately, and doing so only ends up
> further complicating an issue that enough people have trouble learning
> into their bones in the first place.

You are wrong.


PointedEars
-- 
Use any version of Microsoft Frontpage to create your site.
(This won't prevent people from viewing your source, but no one
will want to steal it.)
  -- from <http://www.vortex-webdesign.com/help/hidesource.htm> (404-comp.)

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-02 23:17 -0400
  Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-02 22:57 -0500
    Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 13:07 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-03 22:20 -0500
    Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-04 07:56 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-04 11:20 -0500
        Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-05 03:27 +0200
    Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-05 06:46 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-05 07:14 -0500
        Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-05 20:52 +0200
          Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-05 15:05 -0500
            Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-06 21:50 +0200
        Re: sessions causing refreshing not to work Richard Damon <news.x.richarddamon@xoxy.net> - 2012-06-06 08:34 -0400
  Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 13:21 +0200
    Re: sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-03 09:59 -0400
      Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 16:43 +0200
        Re: sessions causing refreshing not to work Denis McMahon <denismfmcmahon@gmail.com> - 2012-06-03 19:13 +0000
  Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-04 07:59 +0200
  Re: sessions causing refreshing not to work "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2012-06-04 09:12 +0200
  Re: sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-05 16:51 -0400
    Re: sessions causing refreshing not to work The Natural Philosopher <tnp@invalid.invalid> - 2012-06-05 23:09 +0100

csiph-web