in reply to Re: Re: The sound of one cookie (not) authenticating
in thread The sound of one cookie (not) authenticating
Right, hidden fields are not secure. But Hero Zzyzzx was not concerned about secure sessions (I assume he would handle that through SSL). Instead the issue is that customers can mistakenly give away a link into their session just by giving the current URL to someone else.
I don't understand how computing a hash will prohibit sessions from being transferred with URLs. Is the server or the browser going to compute the hash? If the browser, then JavaScript is required (and I believe the issue is not requiring the customer to use cookies, and possibly other optional browser features like JavaScript). If the server, then the URL is usable by any browser (which means that it can be given to others along with the hashed session ID).
|
---|
Replies are listed 'Best First'. | |
---|---|
Re: Re: Re: Re: The sound of one cookie (not) authenticating
by arhuman (Vicar) on Apr 03, 2001 at 17:31 UTC | |
by sutch (Curate) on Apr 03, 2001 at 17:55 UTC |
In Section
Seekers of Perl Wisdom