Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: Ecommerce site - how? Date: Wed, 28 Jun 2017 07:07:07 +0200 Lines: 42 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Trace: individual.net 1fSRTg3h+LuRs64tZqEMCwQR2ryBrvfkUxJEbmZTCYq12PEQFu Cancel-Lock: sha1:l1tMabBHccNj+1htu7MZ5TweC9A= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0 In-Reply-To: Content-Language: en-GB Xref: csiph.com comp.lang.php:17509 On 06/27/17 22:01, R.Wieser wrote: >>> Gee... Do I hear an echo ? Yes, it must be, as that is exactly what I >>> explained in my previous message. :-) >> >> Not at all, you wrote: >> >> "but the PHP session its referring to will be >> destroyed shortly after you leave the server, making that stored ID >> rather worthless." >> >> which is just bs. > > And you said "some sites uses a short life span and other a long.". Explain > to me how thats different from "will be destroyed shortly after you leave > the server". You state yours as if it's the fact that the session cookie expires after you leave a site, which you browser has no concept of, for if you was right, then when you pay on your e-commerce site and are redirected to the payment provider, then when you return back to the e-commerce site your session would have expired. Just for someone can set a cookie lifespan to a short period, do not mean that everyone does that and usually you set a lifespan that you know the customers will be able to finish their shopping before it expires (don't forget that people sometimes want to read about the product before adding it). >> it may protect against session cookie hijacking > > As I have already mentioned earlier (but you deemed it opportune to ignore > it at that time): I highly doubt it, as both the cookie and the CSRF > "secretly stored as part of a form element" data are send at the same time, > in the same request (just at different locations, one in the header, one as > part of the URI or trailing post-data). What would stop anyone from > capturing and using them ? The thing that used is random, so if you do not know what the random data is, then it's more difficult to "capture". PS. CSRF != cookie hijacking