Re: Best practice, (secure), to save session data?

From	Jerry Stuckle <jstucklex@attglobal.net>
Newsgroups	comp.lang.php
Subject	Re: Best practice, (secure), to save session data?
Date	2012-06-18 15:13 -0400
Organization	A noiseless patient Spider
Message-ID	<jrnukk$emr$3@dont-email.me> (permalink)
References	(3 earlier) <pr5ra9xa49.ln2@news.roaima.co.uk> <jrf4si$9es$1@dont-email.me> <8f0sa9xpqm.ln2@news.roaima.co.uk> <jrg5np$pas$1@dont-email.me> <b374b9xcvo.ln2@news.roaima.co.uk>

Show all headers | View raw

On 6/18/2012 2:02 PM, Chris Davies wrote:
> Jerry Stuckle<jstucklex@attglobal.net>  wrote:
>> As I stated - this is not correct.  No one needs to "brute force the
>> data string" to get logged in - all they have to do is send the cookie.
>
> My original quote suggested option 2 as getting access to the data stored
> in the cookie. Real data stored in the cookie, not a session value that
> would/could get you access to the data stored on the website. That you
> might also be able to log in is a potential side-effect and was (from
> my perspective, at least) irrelevant.
>
> Chris

Yes, and my point was - you don't NEED access to the encrypted data. 
All you need to do is send a copy of the cookie itself to log in.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Thread

Best practice, (secure), to save session data? Simon <bad@example.com> - 2012-06-14 10:35 +0200
  Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:46 -0400
  Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-14 13:52 +0100
    Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 12:30 -0400
      Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 08:46 +0100
        Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 07:04 -0400
          Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 16:20 +0100
            Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 16:25 -0400
              Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 19:02 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:13 -0400
                Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 23:12 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 21:30 -0400
                Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 08:37 +0200
  Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:44 +0200

csiph-web