in reply to
Re: Re: The sound of one cookie (not) authenticating
in thread The sound of one cookie (not) authenticating
Right, hidden fields are not secure. But Hero Zzyzzx was not concerned about secure sessions (I assume he would handle that through SSL). Instead the issue is that customers can mistakenly give away a link into their session just by giving the current URL to someone else.