Path: csiph.com!aioe.org!.POSTED!not-for-mail
From: "R.Wieser" <address@not.available>
Newsgroups: comp.lang.php
Subject: Re: Ecommerce site - how?
Date: Tue, 27 Jun 2017 10:48:20 +0200
Organization: Aioe.org NNTP Server
Lines: 59
Message-ID: <oit644$aj2$1@gioia.aioe.org>
References: <d2223e3b-f44c-4ef7-b55a-94e012d85a95@googlegroups.com><oiodsn$pud$1@gioia.aioe.org><PcqdnRTWK6vXeM3EnZ2dnUU7-X3NnZ2d@posted.internetamerica><oir89b$187l$1@gioia.aioe.org> <oirani$2jp$1@solani.org><oirgtl$1po2$1@gioia.aioe.org> <erd6dvFhfi0U1@mid.individual.net><oirtfe$h7d$2@gioia.aioe.org> <ois1r3$jv8$1@solani.org>
NNTP-Posting-Host: XSLsI1Jcl7NultOj/0AyIg.user.gioia.aioe.org
X-Complaints-To: abuse@aioe.org
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200
X-Notice: Filtered by postfilter v. 0.8.2
X-Priority: 3
X-Newsreader: Microsoft Outlook Express 5.00.2615.200
X-MSMail-Priority: Normal
Xref: csiph.com comp.lang.php:17496

Christoph,

> Consider to read up on session.cookie_lifetime
>
(<http://php.net/manual/en/session.configuration.php#ini.session.cookie-life
time>).

I did you one better: I double-checked my knowledge of it by taking a peek
at the RFC for it. :-)

> Consider to take a second stab at it - for your and your readers sake.

Nope.   First off, I have a considerable problem with dealing with "do as I
say, not as I do" people/environments. Secondly, I am definitily not willing
to go on a wild goosehunt to figure out which part could/would be applicable
(to the problem at hand or otherwise) (the CSRF attack mitigation promently
displayed on their front page definitily isn't).  So, either I get a "this
is what I'm talking about" reference, or its a no-go (also, I have no use
for it -- which makes it even less interresting). Sorry.

Regards,
Rudy Wieser


-- Origional message:
Christoph M. Becker <cmbecker69@arcor.de> schreef in berichtnieuws
ois1r3$jv8$1@solani.org...
> On 26.06.2017 at 23:14, R.Wieser wrote:
>
> > Yes, both a cookie and thus the a session ID stored in it can live for
the
> > longest time (depending on the lifetime the website has defined for the
> > cookie-data ofcourse -- which, for a shopping cart of an e-commerce
site,
> > will be rather short), but the PHP session its referring to will be
> > destroyed shortly after you leave the server, making that stored ID
rather
> > worthless.
>
> Consider to read up on session.cookie_lifetime
>
(<http://php.net/manual/en/session.configuration.php#ini.session.cookie-life
time>).
>
> >> If you are interested in learning take a look at OWASP.
> >
> > Nope, not interrested in learning.  No sirree, not at all! /s
> >
> > I just took a quick look at that site (www.owasp.org).   The first thing
I
> > noticed was iframes and JS, both to external sites.   For a fricking
> > *security* minded site.  Don't make me laugh please.  Idiots.
>
> Consider to take a second stab at it - for your and your readers sake.
>
> --
> Christoph M. Becker