Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6262

Re: sessions causing refreshing not to work

Followups directed to: comp.lang.php

Show all headers | View raw

Peter H. Coffin wrote:

> On Tue, 05 Jun 2012 20:52:23 +0200, Thomas 'PointedEars' Lahn wrote:
>> Peter H. Coffin wrote:
>>> On Tue, 05 Jun 2012 06:46:28 +0200, Thomas 'PointedEars' Lahn wrote:
>>>>> Set session.use_trans_sid, unset session.use_cookie, don't forget to
>>>>> grab the session ID out of the $_GET array for every page load. Yes,
>>>>> your URLs will be ugly, and it'll be not impossible for someone to end
>>>>> up screwing things somehow with URL bookmarking or sharing.
>>>>
>>>> More importantly, it will be a security hole to be exploited:
>>>>
>>>><https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Manage_Session_ID_as_Any_Other_User_Input>
>>> 
>>> Sorry, I refuse to think of what *should be* expected behavior
>>
>> It is by no means expected behavior.
> 
> Sure it is.

I am afraid that either I am misunderstanding your position or you do not 
know what you are arguing for or against.

> "DO NOT TRUST THE CLIENT".

That is beside the point.

>>> as a "security hole". People can manipulate cookie values almost as
>>> easily
>>
>> Because of that, HTTP-only cookies have been invented.
> 
> DO NOT TRUST THE CLIENT. That only *helps* mitigate third-party attacks.

DO NOT SHOUT AROUND HERE.  If you read my posting more carefully, you will 
realize that by no means I am saying that we should trust the client.  
However, different approaches result in different risk assessments.  The 
risk of transmitting a session ID accidentally is greater when it is part of 
the URI.  Therefore, it is *safer* (not: safe) to use HTTP-only cookies for 
that than a URI component.

On a side note, storing the session ID in cookies instead of URIs also is 
more search-engine friendly.  The resulting document becomes considerably 
smaller (the more links, the smaller), and no additional measures have to be 
applied that the search engine would not index those URIs.
 
>>> and they're no more trustworthy than a $_GET result.
>>
>> Correct, but by contrast they are not stored unencrypted in the user's
>> history, cannot be accidentally transmitted, and so on.
> 
> If the site's properly policing client input, all of those things are
> dealt with, from the site's perspective.

Intrinsically, they cannot be dealt with completely.

>>> This doesn't even bear discussing separately, and doing so only ends up
>>> further complicating an issue that enough people have trouble learning
>>> into their bones in the first place.
>>
>> You are wrong.
> 
> Heh. Succinct, but about as useful as "You are a doody-head".

That paragraph of yours constituted a fallacy.  There was nothing else to 
reply while staying polite and saving free-time for more important problems.


PointedEars
-- 
Sometimes, what you learn is wrong. If those wrong ideas are close to the 
root of the knowledge tree you build on a particular subject, pruning the 
bad branches can sometimes cause the whole tree to collapse.
  -- Mike Duffy in cljs, <news:Xns9FB6521286DB8invalidcom@94.75.214.39>

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-02 23:17 -0400
  Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-02 22:57 -0500
    Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 13:07 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-03 22:20 -0500
    Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-04 07:56 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-04 11:20 -0500
        Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-05 03:27 +0200
    Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-05 06:46 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-05 07:14 -0500
        Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-05 20:52 +0200
          Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-05 15:05 -0500
            Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-06 21:50 +0200
        Re: sessions causing refreshing not to work Richard Damon <news.x.richarddamon@xoxy.net> - 2012-06-06 08:34 -0400
  Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 13:21 +0200
    Re: sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-03 09:59 -0400
      Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 16:43 +0200
        Re: sessions causing refreshing not to work Denis McMahon <denismfmcmahon@gmail.com> - 2012-06-03 19:13 +0000
  Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-04 07:59 +0200
  Re: sessions causing refreshing not to work "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2012-06-04 09:12 +0200
  Re: sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-05 16:51 -0400
    Re: sessions causing refreshing not to work The Natural Philosopher <tnp@invalid.invalid> - 2012-06-05 23:09 +0100

csiph-web