Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail From: "Peter H. Coffin" Newsgroups: comp.lang.php Subject: Re: sessions causing refreshing not to work Date: Tue, 5 Jun 2012 07:14:22 -0500 Organization: A noiseless patient Spider Lines: 22 Message-ID: References: <1532857.iZYJvXyM37@PointedEars.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Injection-Info: mx04.eternal-september.org; posting-host="le/2G4+BNpieVhQI6uJ2Lw"; logging-data="18794"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19eiIMZ15zjmiSl9Cj/wPxI" User-Agent: slrn/0.9.9p1 (OpenBSD) Cancel-Lock: sha1:FGnpIEsxfnd0JkFxxnL6ZF3dY9s= Xref: csiph.com comp.lang.php:6251 On Tue, 05 Jun 2012 06:46:28 +0200, Thomas 'PointedEars' Lahn wrote: >> Set session.use_trans_sid, unset session.use_cookie, don't forget to >> grab the session ID out of the $_GET array for every page load. Yes, >> your URLs will be ugly, and it'll be not impossible for someone to end >> up screwing things somehow with URL bookmarking or sharing. > > More importantly, it will be a security hole to be exploited: > > Sorry, I refuse to think of what *should be* expected behavior as a "security hole". People can manipulate cookie values almost as easily and they're no more trustworthy than a $_GET result. This doesn't even bear discussing separately, and doing so only ends up further complicating an issue that enough people have trouble learning into their bones in the first place. -- Judging by this particular thread, many people in this group spent their school years taking illogical, pointless orders from morons and having their will to live systematically crushed. And people say school doesn't prepare kids for the real world. -- Rayner, in the Monastery