On 8/27/00, Cameron Childress penned:
>The CFID is a number incremented by one each time a new one is needed. How
>does CF know a new one is needed? Because Client or Session management is
>turned on in the CFAPPLICATION tag, and CF didn't get one as a cookie, URL
>or Form var when the page was called.
>
>Really, a CFID should be all that is required to identify a session.
>Unfortunately, that would make for a very insecure app because user's could
>easily "guess" another session's CFID and hijack the session. Therefore, a
>CFTOKEN is used to make the CFID harder to guess. The CFTOKEN is a randomly
>generated number which provides security against someone guessing a CFID
>number. The CFID/CFTOKEN pair is very unique and hard to guess.
Wonderful.
Thank you. :)
--
Bud Schneehagen - Tropical Web Creations
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
ColdFusion Solutions / eCommerce Development
[EMAIL PROTECTED]
http://www.twcreations.com/
954.721.3452
------------------------------------------------------------------------------
Archives: http://www.mail-archive.com/[email protected]/
To Unsubscribe visit
http://www.houseoffusion.com/index.cfm?sidebar=lists&body=lists/cf_talk or send a
message to [EMAIL PROTECTED] with 'unsubscribe' in the body.
