> Really, a CFID should be all that is required to identify a session.
> Unfortunately, that would make for a very insecure app because
> user's could
> easily "guess" another session's CFID and hijack the session.
> Therefore, a
> CFTOKEN is used to make the CFID harder to guess. The CFTOKEN is
> a randomly
> generated number which provides security against someone guessing a CFID
> number. The CFID/CFTOKEN pair is very unique and hard to guess.
> -Cameron
Or, using an analogue, CFID is the "username" and CFTOKEN is the "password".
Same effect.
--min
------------------------------------------------------------------------------
Archives: http://www.mail-archive.com/[email protected]/
To Unsubscribe visit
http://www.houseoffusion.com/index.cfm?sidebar=lists&body=lists/cf_talk or send a
message to [EMAIL PROTECTED] with 'unsubscribe' in the body.
