> Yikes, that's a long one - not really what I was after but interesting > anyway.
I used to think sessions were using some weird voodoo & by the sounds of that previous thread a bunch of other people do too. I guess I just wanted to share what I've picked up. Working with sessions & debugging session related problems is much easier if you know how they work. > I reckon it has nothing to do with CFID/CFTOKEN any session > identifier from > any language is interceptable to this kind of hijacking. True - pretty much all server side languages that I have seen use a variation on this method. > I reckon you can > make it a bit more difficult by looking at the remote IP or > xhttp_forwarded_for (I believe that's what it is) if behind a proxy. > I know, still not 100% secure, but securer... If you need security just use HTTPS, all the rest of that CGI information (remote IP & xhttp_forwarded_for) is also getting passed in plain text so it does add any real value in terms of security (http://en.wikipedia.org/wiki/Security_through_obscurity). > I should have posted the whole thread I was talking about, > someone said that > if you open a browser and start a session, then open a new browser, not by > clicking file -> new, but by actually clicking the browser icon again and > opening a new browser and start another session - you can maintain two > sessions, I thought it was a bit weird myself, but other people > confirmed if > I am not mistaken.. I remember the thread & I was the one that said that. I *have* seen this happen before, but testing it in IE6 you are right the session gets shared. Maybe it was an older version of IE? I thought you meant different browsers, not different instances of the same browser. Just get Firebird & use that & IE to test multiple session. Alternatively you could create your own session management system if you really need two "session" in the one browser - good luck. Cheers Mark ------------------ Mark Stanton Technical Director Gruden Pty Ltd Tel: 9956 6388 Mob: 0410 458 201 Fax: 9956 8433 http://www.gruden.com --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004
