Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6251

Re: sessions causing refreshing not to work

Show all headers | View raw

On Tue, 05 Jun 2012 06:46:28 +0200, Thomas 'PointedEars' Lahn wrote:
>> Set session.use_trans_sid, unset session.use_cookie, don't forget to
>> grab the session ID out of the $_GET array for every page load. Yes,
>> your URLs will be ugly, and it'll be not impossible for someone to end
>> up screwing things somehow with URL bookmarking or sharing.
>
> More importantly, it will be a security hole to be exploited:
>
><https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Manage_Session_ID_as_Any_Other_User_Input>

Sorry, I refuse to think of what *should be* expected behavior as a
"security hole". People can manipulate cookie values almost as easily
and they're no more trustworthy than a $_GET result. This doesn't even
bear discussing separately, and doing so only ends up further
complicating an issue that enough people have trouble learning into
their bones in the first place.

-- 
Judging by this particular thread, many people in this group spent their
school years taking illogical, pointless orders from morons and having
their will to live systematically crushed. And people say school doesn't
prepare kids for the real world. -- Rayner, in the Monastery

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-02 23:17 -0400
  Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-02 22:57 -0500
    Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 13:07 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-03 22:20 -0500
    Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-04 07:56 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-04 11:20 -0500
        Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-05 03:27 +0200
    Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-05 06:46 +0200
      Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-05 07:14 -0500
        Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-05 20:52 +0200
          Re: sessions causing refreshing not to work "Peter H. Coffin" <hellsop@ninehells.com> - 2012-06-05 15:05 -0500
            Re: sessions causing refreshing not to work Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-06 21:50 +0200
        Re: sessions causing refreshing not to work Richard Damon <news.x.richarddamon@xoxy.net> - 2012-06-06 08:34 -0400
  Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 13:21 +0200
    Re: sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-03 09:59 -0400
      Re: sessions causing refreshing not to work Fred <fr-icsr@numericable.fr> - 2012-06-03 16:43 +0200
        Re: sessions causing refreshing not to work Denis McMahon <denismfmcmahon@gmail.com> - 2012-06-03 19:13 +0000
  Re: sessions causing refreshing not to work Arno Welzel <usenet@arnowelzel.de> - 2012-06-04 07:59 +0200
  Re: sessions causing refreshing not to work "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2012-06-04 09:12 +0200
  Re: sessions causing refreshing not to work Michael Joel <null@void.void> - 2012-06-05 16:51 -0400
    Re: sessions causing refreshing not to work The Natural Philosopher <tnp@invalid.invalid> - 2012-06-05 23:09 +0100

csiph-web