Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: Ecommerce site - how? Date: Mon, 26 Jun 2017 21:42:55 +0200 Lines: 44 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Trace: individual.net pLVpmeAxBFDbgo4RbHTVpQa6uurBxcu7pwOdaky013jiH2EE8f Cancel-Lock: sha1:V5u0Q5UeKCAQe3oLrOyBHiECUoA= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0 In-Reply-To: Content-Language: en-GB Xref: csiph.com comp.lang.php:17488 On 06/26/17 19:40, R.Wieser wrote: > Christoph, > >> And yes, using a PHP session instead is usually the appropriate >> solution. *Extremly* simplified: > > *Over* simplified I'm afraid. What you put down there (remembering the IDs > of the selected products) can be done by using cookies. Which would be possible to tamper and give another attack vector on the site. And can cause some browser to get issues if the data amount is too big as when you are ordering many different things at the same time. > ... which would, in this simplified case, even be preferrable, as than the > user can stop, and restart shopping (even days later) whenever they want > (which is not possible using a basic PHP session). Session cookie can have a long lifespan too, so the user could come back and continue with what is stored in the session. > The idea is to, when the PHP session is created, store the clients IP and > check it with the stored one on subsequent usages*. And this can just lead to issues which we already pointed out. This is a technique used in the early days of internet but didn't work out too well and didn't give any extra security. > While it certainly is > possible to (even without attempting to do so) hijack an IP, sending the > correct session-ID with it is a whole other ballgame. Especially when done > over SSL. There are other methods which are more used nowadays, when the request will come from the users browser, but a request orchestrated by a third party, far less work than spoofing IP which ain't too difficult. If you are interested in learning take a look at OWASP. -- //Aho